February 2002 - openSUSE Security - openSUSE Mailing Lists

CERT snmp advisory and SuSE
by Togan Muftuoglu 25 Feb '02

25 Feb '02

Hi Can someone from SuSE confirm if SuSE package ucdsnmp is also vulnerable for the vulnerabilities listed on this advisory. I could not find SuSE name on the list but that is another issue. Thanks in advance CERT Advisory CA-2002-03: Multiple Vulnerabilities in Many Implementations of the Simple Network Management Protocol (SNMP) Original release date: February 12, 2002 Last revised: -- Source: CERT/CC Systems Affected Products from a very wide variety of vendors may be affected. See Vendor Information for details from vendors who have provided feedback for this advisory. In addition to the vendors who provided feedback for this advisory, a list of vendors whom CERT/CC contacted regarding these problems is available from http://www.kb.cert.org/vuls/id/854306 http://www.kb.cert.org/vuls/id/107186 Many other systems making use of SNMP may also be vulnerable but were not specifically tested.

7 7

Re: [suse-security] After updating cups no default printer avaible
by Klaus Ruhwinkel 25 Feb '02

25 Feb '02

On Mon, 25 Feb 2002, Manfred Schirmer wrote: > On Monday 25 February 2002 09:22, you wrote: > > Hello, > > > > after updating cups on my Suse 7.2, i have no default printer. > > > > lp printers.conf > > lpr: error - no default destination available > > > > Printing works fine with the command lp -P printer ... > > Any hints > > Hi Klaus > start kups (KDE cups admin tool) as root and define your default > I have no KDE installed I am using XFCE. I use the web interface from cups and there are no printers too. The config files in /etc/cups are the same as before updating cups and ps shows root 5578 1 0 09:00 ? 00:00:00 /usr/sbin/cupsd -c /etc/cups/cupsd.conf So what is the problem? Klaus

1 0

Re: [suse-security] VMWare through SuSEFirewall2
by Michael Stern 24 Feb '02

24 Feb '02

> How do you manage to apply anti-spoofing rules to just the external interface > with SuSEFW2? i don't use the suse firewall. basically, doesn't the suse-firewall use iptables? the entries it logs remind me a lot of iptables-logging with the --log-prefix option. if so, it should be possible, to look at the rules by typing "iptables -L INPUT". copy the anti-spoofing stuff from the suse-firewall, disable it in the suse-firewall-config file and put them into your own firewall script. just a thought, never tried it though. > That's the workaround I am doing at the moment. I stop and restart manually > the script after vmware is started. well, you still could do it some kind of semi-automatically by restarting the firewall at the end of vmware's init script. cheers, michael

1 0

[suse-security] VMWare through SuSEFirewall2
by Michael Stern 24 Feb '02

24 Feb '02

i apply anti-spoofing rules only for the internet interface, so vmware is never affected by it. what if you reapply the firewall script after vmware has started? > I have SuSEFirewall2 running in my laptop to drop every incoming connection > but ssh and http. Last week I installed VMWare with both host-only and > bridged network configurations. > So now I have two new network devices. This is output from ifconfig: > (...) > > The firewall doesn't know about the new interfaces... and so it complains: > > Feb 24 17:48:42 petit kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=vmnet1 OUT= MAC= > SRC=172.16.134.1 DST=172.16.134.255 LEN=240 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF > PROTO=UDP SPT=138 DPT=138 LEN=220 >

2 1

VMWare through SuSEFirewall2
by Pep Serrano 24 Feb '02

24 Feb '02

I have SuSEFirewall2 running in my laptop to drop every incoming connection but ssh and http. Last week I installed VMWare with both host-only and bridged network configurations. So now I have two new network devices. This is output from ifconfig: vmnet1 Link encap:Ethernet HWaddr 00:50:56:C0:00:01 inet addr:172.16.134.1 Bcast:172.16.134.255 Mask:255.255.255.0 inet6 addr: fe80::250:56ff:fec0:1/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:111 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) vmnet8 Link encap:Ethernet HWaddr 00:50:56:C0:00:08 inet addr:172.16.144.1 Bcast:172.16.144.255 Mask:255.255.255.0 inet6 addr: fe80::250:56ff:fec0:8/10 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:4 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) The firewall doesn't know about the new interfaces... and so it complains: Feb 24 17:48:42 petit kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=vmnet1 OUT= MAC= SRC=172.16.134.1 DST=172.16.134.255 LEN=240 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=138 DPT=138 LEN=220 I already tried to set both interfaces in the firewall config to be my internal interfaces: FW_DEV_INT="vmnet1 vmnet8". But when the FW loads the rules at boot time VMWare is not started yet and interfaces vmnet1 and vmnet8 do not exist. I get the following error: Starting Firewall Initialization: (phase 2 of 3) modprobe: modprobe: modprobe: Can't locate module vmnet1 modprobe: modprobe: Can't locate module vmnet8 failed So, how do you configure your virtual NICs to go through the firewall???

1 0

Firewall2 and DMZ
by Kevin Passey 24 Feb '02

24 Feb '02

Hi, Can anybody point me to a document about DMZ. Thanks Kevin Passey To unsubscribe, e-mail: mailto:suse-security-unsubscribe@suse.com For additional commands, e-mail: mailto:suse-security-help@suse.com Security-related bug reports go to mailto:security@suse.de, not here

2 1

E-Mail spam?
by thiemo 23 Feb '02

23 Feb '02

Hi, lately, I receive strange e-mails to users on a private lan. Below a sample header: Von: <magicalworx516104(a)genie.de> Datum: Mit, 20. Feb. 2002 14:56:12 Europe/Zurich An: User(a)213.165.64.20 Betreff: Werbung: Sicherheitshinweis Antwort an: <magicalworx516104(a)genie.de> Return-Path: <magicalworx516104(a)genie.de> Delivered-To: mail_thiemo(a)localhost.thiam.ch Delivered-To: GMX delivery to thiemo(a)gmx.ch Received: from localhost (localhost [127.0.0.1]) by nyffeltrach.thiam.ch (Postfix on SuSE Linux 7.2 (i386)) with ESMTP id 1BE6DC0D1 for <mail_thiemo@localhost>; Wed, 20 Feb 2002 15:00:08 +0100 (CET) Received: from 213.165.64.20 [213.165.64.20] by localhost with POP3 (fetchmail-5.8.0) for mail_thiemo@localhost (single-drop); Wed, 20 Feb 2002 15:00:08 +0100 (CET) Received: (qmail 20586 invoked by uid 0); 20 Feb 2002 13:56:10 -0000 Received: from unknown (HELO genie.de) (211.185.197.130) by mx0.gmx.net (mx021-rz3) with SMTP; 20 Feb 2002 13:56:10 -0000 X-Flags: 0000 Message-Id: <001b34b36dae$3645e3e6$4ea80ba3@phemik> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-Msmail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 Importance: Normal Now my questions. How is this possible when thiam.ch doesn't even exist in the internet? Do I have an uninvited guest on my Postfix mail server, which is, by the way, behind a firewall and uses a private IP address? Is there a HowTo explaining how to set up postfix with user password etc? Maybe even over a secure connection? Thx Thiemo -- Thiemo Kellner Tösstalstrasse 146 CH-8400 Winterthur

2 1

SuSEFirewall2
by andre＠do 23 Feb '02

23 Feb '02

Hi All, Firstly my config as follows : SuSE 7.3 - 2.4.16 kernel firewall2 config : FW_DEV_EXT="eth0" FW_DEV_INT="eth2" FW_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="22" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="25 80" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="0/0,100.100.100.100,tcp,80 0/0,100.100.100.100,tcp,25" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" added : route add 100.100.100.100 dev eth1 and : echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp route shows all routes is up now : when i turn the firewall off i can ping the webserver&mailserver in DMZ and i can ping the pvt. subnet. When i turn the firewall on the pvt subnet can get to the internet but nothing gets in our out from the DMZ var/log/firewall = DROP-ANTISPOOFING 100.100.100.100 Without changing the iptables rules (I trust mark's rules explicitly) can someone please tell me what i am doing wrong on this FW2 config there must be something very basic that i am missing ? Thank you so much for reading this long post. tia andre

1 0

Drop of Broadcasts
by Dominik.Brosch＠epost.de 22 Feb '02

22 Feb '02

Hi, Very simple question: How does a rule have to look, when I like to drop Broadcasts? I can't find any documentation about this. Thanks for your help. Greetings Dominik ________________________________________ Zeitschriftenabos online bestellen - jetzt neu im Infoboten! http://www.epost.de

4 4

RE: [suse-security] hacked??
by Leen de Braal 22 Feb '02

22 Feb '02

Hello Matthias, Thks for the advice. In this case it was a home server indeed, but I will check on honeynet later today, because I also have built servers for a few small companies. Now these are not directly connected to the Internet, like my machine is, so risk is little lower I think, but of course it is necessary to keep these machines up to date. So for me this is a good learning experience, and I will dig in deeper coming days. Server in the meantime is upgraded to Suse 7.2 with latest openssh, installed chkrootkit, seccheck and some more monitoring tools. Leen At 13:31 22-2-2002 +0100, you wrote: >Hi Leen, >since your question was somedays ago, this is probably not more an issue >for you. But I think, the further actions depend on the context. If the >hacked system is part of a small private home LAN reinstalling the system >with the latest Software could be sufficient. If the machine is part of a >corporate lan you should consider further investigations. There are some >good articles in the german "Linux Magazin" which discuss what to do. The >hacker could have started some sniffers and gathered some important >password, i.e. for your public ftp server aso. Probably the hacker harmed >your company and your company will hold the hacker responsible for the >damage, you should look for evidence then. In either case >http://project.honeynet.org is a pretty good source for information. >Nevertheless IMHO it is pretty dangerous just to replace some corrupted >files without an precise analysis, since there are some rootkits which >contain kernel loadable modules. These modules try to hide the existence >of corrupted files and additional running processes (see latest issue of >magazin c't). >So you even just think your files are okay ? > >regards >Matthias Brocks <<SNIP>>

1 0