April 2002 - openSUSE Security - openSUSE Mailing Lists

SuSE 7.2 and zlib vulnerability
by Roland Moriz 14 Apr '02

14 Apr '02

Hi Folks, I'm not a linux library geek but I found something courious: I've scanned my SuSE 7.2 prof. system after updating the packages as described in http://www.suse.de/de/support/security/2002_010_libz_txt.html and http://www.suse.de/de/support/security/2002_011_libz_packages_txt.html for libz and I found the following: ==== Short == Name : shlibs5 Relocations: (not relocateable) Version : 2001.7.30 Vendor: SuSE GmbH, Nuernberg, Germany Release : 21 Build Date: Mon Sep 17 00:13:19 2001 Install date: Fri Oct 5 22:22:29 2001 Build Host: D45.suse.de seems still to have a vulnerable zlib: /usr/i486-linux-libc5/lib/libz.so /usr/i486-linux-libc5/lib/libz.so.1 /usr/i486-linux-libc5/lib/libz.so.1.1.3 Maybe someone can have a closer look into that? regards, Roland ==== LONG === s1:/usr/i486-linux-libc5/lib # locate libz /lib/libz.so.1 /lib/libz.so.1.1.3 ... /usr/i486-linux-libc5/lib/libz.so /usr/i486-linux-libc5/lib/libz.so.1 /usr/i486-linux-libc5/lib/libz.so.1.1.3 ... /usr/lib/libz.a /usr/lib/libz.so ... Then I checked the update zlib package: s1:/usr/i486-linux-libc5/lib # rpm --query -a |grep libz libz-1.1.3-573 s1:/usr/i486-linux-libc5/lib # rpm --query libz-1.1.3-573 -l /lib/libz.so.1 /lib/libz.so.1.1.3 ... /usr/include/zlib.h ... /usr/lib/libz.a /usr/lib/libz.so ... So I'm suprised of that because the zlib in /usr/i486-linux-libc5/lib/ seems to be old an vulnerable! I found that the zlib there belongs to "shlibs5": s1:/usr/i486-linux-libc5/lib # rpm --query -f /usr/i486-linux-libc5/lib/libz.so shlibs5-2001.7.30-21 s1:/usr/i486-linux-libc5/lib # rpm -qi shlibs5 Name : shlibs5 Relocations: (not relocateable) Version : 2001.7.30 Vendor: SuSE GmbH, Nuernberg, Germany Release : 21 Build Date: Mon Sep 17 00:13:19 2001 Install date: Fri Oct 5 22:22:29 2001 Build Host: D45.suse.de It looks like this is the latest version (ftp://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse/i386/update/7.2/a2) regards, Roland

1 0

SuSE-FW-DROP-ANTI-SPOOFING message
by Bob Berman 14 Apr '02

14 Apr '02

I am getting the following message roughly once a minute: Apr 13 13:45:10 telluride kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=eth1 OUT= MAC= SRC=192.168.0.1 DST=192.168.0.255 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56 My logs are filling up. I have searched Google and other places, but all I have found are some emails in German which I don't speak. Can anyone help me with this? What is going on and what should I do about it? Thanks!

1 0

SuSE-FW-DROP-ANTI-SPOOFING messages
by Bob Berman 13 Apr '02

13 Apr '02

I am getting the following message roughly once a minute: Apr 13 13:45:10 telluride kernel: SuSE-FW-DROP-ANTI-SPOOFINGIN=eth1 OUT= MAC= SRC=192.168.0.1 DST=192.168.0.255 LEN=76 TOS=0x10 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=123 DPT=123 LEN=56 My logs are filling up. I have searched Google and other places, but all I have found are some emails in German which I don't speak. Can anyone help me with this? What is going on and what should I do about it? Thanks!

1 0

Re: [suse-security] openssh client configuration files
by Steffen Dettmer 13 Apr '02

13 Apr '02

Hi, I reply to this old message, since at least it gives hints about a problem. Are more concrete problem or question would be nice, anyway. * Joerg Ruhe wrote on Wed, Apr 10, 2002 at 17:17 +0200: > 1. command line options, > 2. user's configuration file ($HOME/.ssh/config) > 3. system-wide configuration file (/etc/ssh/ssh_config) > > and for each parameter the first obtained value will be used. For me that > means, that if I set an parameter in my $HOME/.ssh/config > and agin in /etc/ssh/ssh_config the value from the $HOME/.ssh/config will be > used. According to the man page, this is correct. > My trouble is, I'm observing a differnt behaviour ( as you can see in the > log below ): > OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug1: Reading configuration data /home/ruhej/.ssh/config > debug1: Applying options for * > > Here the options in the system-wide configuration file are applied first. Well, it looks so. But this output is a debug output, and it may mean that the options are just read and parsed. Internally the later options may overwrite the first; who knows (oki, the sources know :)). > I have seen this on several differnt computers, all with SuSE > 7.3 and openssh 2.9.9p2 . Well, is this your onliest problem? Is the effect correct, anyway? I wouldn't take it as a serious problem to have non-precises debug output... > I would be glad, if somebody could help me with this problem ( or tell me > what I did wrong ). I didn't even understood the problem, I assume. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.

1 0

Proxy Problems
by Andreas.Novak＠student.fh-nuernberg.de 13 Apr '02

13 Apr '02

Dear list, I got problems with a proxy server for a small LAN. The server crashes very often, I've read the logs, but can't find a hint about how to change the server configuration. The following services are running on the machine: -sshd ( PublicKeyAuthentication ) -apache -tomcat J2EE Engine -pdnsd ( DNS Daemon ) -socks4 -socks5 Can anyone tell me which logs to check? Here's an excerpt from messages: Apr 12 20:13:00 linux pppd[3435]: sent [LCP EchoReq id=0x99 magic=0x133d167d] Apr 12 20:13:00 linux pppd[3435]: rcvd [LCP EchoRep id=0x99 magic=0x73cb21e2] Apr 12 20:21:48 linux syslogd 1.4.1: restart. Apr 12 20:21:53 linux ddclient[352]: SUCCESS: updating XXX.XXXXXX.xom: good: IP address set to 217.235.77.3 Apr 12 20:21:53 linux kernel: klogd 1.4.1, log source = /proc/kmsg started. Apr 12 20:21:53 linux kernel: Inspecting /boot/System.map-2.4.10-4GB Apr 12 20:21:55 linux /usr/sbin/cron[461]: (CRON) STARTUP (fork ok) Apr 12 20:21:55 linux kernel: Loaded 11713 symbols from /boot/System.map-2.4.10-4GB. Apr 12 20:21:55 linux kernel: Symbols match kernel version 2.4.10. Apr 12 20:21:55 linux kernel: Loaded 270 symbols from 9 modules. Apr 12 20:21:55 linux kernel: ne2k-pci.c:v1.02 10/19/2000 D. Becker/P. Gortmaker Apr 12 20:21:55 linux kernel: http://www.scyld.com/network/ne2k-pci.html Apr 12 20:21:55 linux kernel: eth0: RealTek RTL-8029 found at 0xef80, IRQ 12, 00:40:95:41:61:EB. Apr 12 20:21:55 linux kernel: 8139too Fast Ethernet driver 0.9.18a Apr 12 20:21:55 linux kernel: eth1: RealTek RTL8139 Fast Ethernet at 0xc4814f00, 00:30:84:3d:7d:f8, IRQ 5 Apr 12 20:21:55 linux kernel: eth1: Identified 8139 chip type 'RTL-8139C' Apr 12 20:21:55 linux kernel: eth1: Setting half-duplex based on auto-negotiated partner ability 0000. Apr 12 20:21:55 linux kernel: CSLIP: code copyright 1989 Regents of the University of California Apr 12 20:21:55 linux kernel: PPP generic driver version 2.4.1 Apr 12 20:21:55 linux kernel: IPv6 v0.8 for NET4.0 Apr 12 20:21:55 linux kernel: IPv6 over IPv4 tunneling driver Apr 12 20:22:02 linux pppd[214]: sent [LCP EchoReq id=0x1 magic=0xba891d2] Apr 12 20:22:02 linux pppd[214]: rcvd [LCP EchoRep id=0x1 magic=0x6e7cdfb8] Apr 12 20:22:05 linux kernel: eth0: no IPv6 routers present Apr 12 20:22:05 linux kernel: eth1: no IPv6 routers present Apr 12 20:22:22 linux pppd[214]: sent [LCP EchoReq id=0x2 magic=0xba891d2] Apr 12 20:22:22 linux pppd[214]: rcvd [LCP EchoRep id=0x2 magic=0x6e7cdfb8] Apr 12 20:22:42 linux pppd[214]: sent [LCP EchoReq id=0x3 magic=0xba891d2] Apr 12 20:22:42 linux pppd[214]: rcvd [LCP EchoRep id=0x3 magic=0x6e7cdfb8] Apr 12 20:22:42 linux pdnsd[572]: pdnsd-1.1.7a starting. Apr 12 20:22:46 linux ssockd[588]: starting... Apr 12 20:22:47 linux ssockd[589]: bound to iface 192.168.1.1, port 1080 In the warn file, I got a number of kernel asserts like these Apr 8 12:20:10 linux kernel: KERNEL: assertion (flags&MSG_PEEK) failed at tcp.c(1463):tcp_recvmsg Apr 8 12:20:10 linux kernel: KERNEL: assertion (tp->copied_seq == tp->rcv_nxt || (flags&(MSG_PEEK|MSG_TRUNC))) failed at tcp.c(1520):tcp_recvmsg Apr 9 01:55:06 linux pppd[4317]: tcflush failed: Input/output error Apr 9 01:55:12 linux pppd[4337]: PAP authentication failed the last time it crashed, I found the following entries in the warn log: Apr 12 20:13:07 linux pppd[3435]: Child process /usr/sbin/pppoe -p /var/run/pppoe.conf-adsl.pid.pppoe -I eth1 -T 80 -U -m 1412 (pid 3436) terminated with signal 11 Apr 12 20:13:07 linux kernel: Unable to handle kernel paging request at virtual address d2bb0318 Apr 12 20:13:07 linux kernel: printing eip: Apr 12 20:13:07 linux kernel: c012cc0a Apr 12 20:13:07 linux kernel: *pde = 00000000 Apr 12 20:21:55 linux kernel: eth0: RealTek RTL-8029 found at 0xef80, IRQ 12, 00:40:95:41:61:EB. last log thing is: Apr 13 00:15:29 linux su: (to nobody) root on none Apr 13 00:15:29 linux PAM-unix2[1215]: session started for user nobody, service su Apr 13 00:15:49 linux pppd[214]: sent [LCP EchoReq id=0xbe magic=0xba891d2] Apr 13 00:15:49 linux pppd[214]: rcvd [LCP EchoRep id=0xbe magic=0x6e7cdfb8] Apr 13 00:16:09 linux pppd[214]: sent [LCP EchoReq id=0xbf magic=0xba891d2] Apr 13 00:16:09 linux pppd[214]: rcvd [LCP EchoRep id=0xbf magic=0x6e7cdfb8] Apr 13 00:16:21 linux PAM-unix2[1215]: session finished for user nobody, service su in messages. what does this mean? Nobody was working at this time! thanks in advance Andreas --_OPERAB__-x0s3yvauQ3lmYTFVC3nEYO--

3 2

Proxy
by Andreas.Novak＠student.fh-nuernberg.de 13 Apr '02

13 Apr '02

the log file entries included are the entries, when the server last crashed. are there any other log files except /var/log/messages and var/log/warn?

1 0

Post YOU problem with mtr
by Jim Westbrook 13 Apr '02

13 Apr '02

For months I have run a cron/script that calls mtr in report mode. Here's one of the lines: mtr -rc 5 www.io.com >>testrpt Prior to a YOU update earlier this week, this had always produced the output described in the man page. Now, all it does is write the header portion of the "report" and no data. I am unsure exactly what was updated by YOU on my 7.3 "everything" installation, but something seems to have broken mtr's output redirection. I have tried several things attempting to restore the previous functionality. rpm -e mtr, then ftp the most recent version from SuSE.com (mtr-0.44-132.rpm) and install it (rpm -i mtr-0.44-132.rpm). The installation worked as expected, but mtr still didn't output the "report" data. rpm -e mtr-0.44-132, the use the 7.3 Pro CD's to re-install the original version in the hope that the upgrade was broken. Not the problem because the mtr-0.44-36 on the CD's still has the output problem. Admittedly, this is not a major security issue, but if the YOU process broke mtr, what else got broken that I have not discovered yet? Is there a way to find what was changed during that YOU session? Is there a way to get mtr working again? The LinkSys cable/router that I'm using kills traceroute, and mtr was the only thing I had found to give me some form of trace info. JimW

1 0

Re: [suse-security] openssh client configuration files
by Roland Kuhn 12 Apr '02

12 Apr '02

On Thu, 11 Apr 2002, Joerg Ruhe wrote: > [...] > > > Thats exactly what happend. A setting in /etc/ssh/ssh_config overrides an > > > user setting ( I tried this with several options ). > > > > > > Does it work that way on your system ? > > > > These are from my system: > > > > debug1: Reading configuration data /home/rkuhn/.ssh/config > > debug1: Applying options for * > > debug1: Reading configuration data /etc/ssh/ssh_config > > debug1: Applying options for * > > > > I just verified that the settings from /home/rkuhn/.ssh/config override > > the ones from /etc/ssh/ssh_config. > > Thanks for your very fast answer. > > Could you tell me your suse and openssh version ? (mine is 7.3 and 2.9.9p2 ) > Sorry, but the fast answer was wrong :-( It works as expected with OpenSSH 3.0.2p1 (RedHat 7.2.1beta2 from CERN), but I can reproduce your problem of /etc/ssh/ssh_config overriding user values with OpenSSH 2.9.9p2 (SuSE 7.3, unpatched). I know this version has this "off-by-one-bug", but I did not yet have the time to recompile... > I'm thinking the effekt Im observing has perhaps something to do with the > last openssh patch from suse, but I can't verify it. > Maybe. Ciao, Roland +---------------------------+-------------------------+ | TU Muenchen | | | Physik-Department E18 | Raum 3558 | | James-Franck-Str. | Telefon 089/289-12592 | | 85747 Garching | | +---------------------------+-------------------------+

2 1

Re: [suse-security] openssh client configuration files
by Gerhard Sittig 12 Apr '02

12 Apr '02

On Wed, Apr 10, 2002 at 17:17 +0200, Joerg Ruhe wrote: > > The man page and the o'reily book state the order in which configuration data > is obtained as : > 1. command line options, > 2. user's configuration file ($HOME/.ssh/config) > 3. system-wide configuration file (/etc/ssh/ssh_config) > > and for each parameter the first obtained value will be used. For me that ^^^^^ ^^^^ > means, that if I set an parameter in my $HOME/.ssh/config > and agin in /etc/ssh/ssh_config the value from the $HOME/.ssh/config will be > used. Right. That's a regular philosophy which generally applies in UNIX systems: The software author suggests some compiled in defaults, the admin may provide a system wide default config for a site, the user is free to customize things for everyday use while still being able to overide settings on the command line for a single invocation. That's accepted and most of all expected behaviour. > My trouble is, I'm observing a differnt behaviour ( as you can see in the > log below ): > OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090602f > debug1: Reading configuration data /etc/ssh/ssh_config > debug1: Applying options for * > debug1: Reading configuration data /home/ruhej/.ssh/config > debug1: Applying options for * I cannot see a deviation from the doc here, it's just a different POV: Reading configuration files in the "from general to more specific" order and applying parameters from the command line last will result in the very effect the doc states -- the most specific settings will "win". So where's the problem? Should you not get what you expected from reading the doc please show the /etc and the $HOME config sections and the logs (ssh -v) which prove that the program does otherwise. The cite above doesn't qualify as "behaviour differs from design" but is quite the opposite. :) No matter how it's implemented, you get the promised functionality. virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig(a)gmx.net -- If you don't understand or are scared by any of the above ask your parents or an adult to help you.

2 1

Re: [suse-security] netcat
by ts 12 Apr '02

12 Apr '02

> Hi Ian, > > > I have been considering using netcat with the minus z > option as an > > enterprise monitoring solution to test the availability > of smtp, http, > > lotusnotes SAP etc. but read in > http://rr.sans.org/audit/netcat.php that it > > was not recommended for use in production systems. Does > anyone know why ? > > Also does anyone know of a safer alternative? > > > > I guess that they recommend to install netcat only if you > need it. By > consequence, you have to install it if you want to use it. > They argue in > that website that it's safer to not have programs > installed that you don't > need. To me, this seems to be the only argument against > installing (and > thereby also using) it. Security breaches in netcat seem > rather unlikely. > > > Warm Regards > > Thanks, > Roman. > -- I read this also with some disbelief and was motivated to reply to the sender originally. netcat is a smaller hole (in potential at least) than any of the scripting languages that offer socket API's IMO.

1 0