June 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Re: [suse-security-announce] SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by Ryan Swenson 26 Jun '02

26 Jun '02

FYI -SuSE Gang http://online.securityfocus.com/advisories/4230 Vendor security teams should investigate the validity of their claims before suggesting all its customers obtain a workaround version released just a short while ago.

2 1

firewall and mail relay/forwarder
by matthew zonderop 26 Jun '02

26 Jun '02

Hi All, I am running SuSEfirewall2 and I would like it to act as mail relay/forwarder for my internal mail server. I am having some config issues. Could someone help me out with the sendmail config....it works sort of...... matthew

1 0

RE: [suse-security] More information on the OpenSSH vulnerability
by Alan Rouse 26 Jun '02

26 Jun '02

I have to say, SuSE has done an excellent job under difficult circumstances in this matter. Thank you for looking out for us. -----Original Message----- From: Olaf Kirch [mailto:okir@suse.de] Sent: Wednesday, June 26, 2002 1:58 PM To: suse-security(a)suse.com Subject: [suse-security] More information on the OpenSSH vulnerability -----BEGIN PGP SIGNED MESSAGE----- ISS and the OpenSSH team just released advisories concerning the OpenSSH vulnerability. These advisories state that the vulnerability exists only if the package has been compiled with support for S/Key or BSDAUTH authentication. Inspecting the patches included in the OpenSSH advisory however show that there is a second vulnerability that can be exploited when interactive keyboard mode is enabled (via the PAMAuthenticationViaKbdInt option in sshd_config). Neither S/Key or BSDAUTH were enabled in previous RPMs released by SuSE (i.e. the OpenSSH 2.9.9p2 RPMs previously released on March 6, and the OpenSSH 3.0.2p1 RPMs released with SuSE Linux 8.0). Support for interactive keyboard mode is compiled in, and is off by default in recent RPMs. However, it can be enabled by the administrator. Which means that, in the default configuration, SuSE Linux users are not affected by this vulnerability. We will release another set of RPMs that fix this vulnerability soon. -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPRoAK3ey5gA9JdPZAQGPYwf+LM2z48HlQLHZBkKcKKjJPHyxVlK4JcFs vqyfcXTgXpjw1ja4NAZpYipMTCHC46IRVjiWHOxKTku2fyUjWe/w3/HdBnY7C51m Un2O7/LcxUrCLipnz6M8c+RzGoWbLQlne0Q8ohPkEcIIOIGBzVYQ+eHjKVY4QYDy +bCA/I+DhsS1QVmdgysNGWjuTd3oiUCYypb1ICLDhE2H0lD3su/HHzhJbFn+lT/a SKqlAwlYGcnL0+776gz1hx084uHKI29BvRaFDmtQ9MVbfDG/Tc/DqqtskPxtSsLL ZkvdPLyQOTjLxZkp7BBDH+1NSim+7t9xiYw8T2kYSsnRlZm8BreOlA== =LoIo -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

More information on the OpenSSH vulnerability
by Olaf Kirch 26 Jun '02

26 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- ISS and the OpenSSH team just released advisories concerning the OpenSSH vulnerability. These advisories state that the vulnerability exists only if the package has been compiled with support for S/Key or BSDAUTH authentication. Inspecting the patches included in the OpenSSH advisory however show that there is a second vulnerability that can be exploited when interactive keyboard mode is enabled (via the PAMAuthenticationViaKbdInt option in sshd_config). Neither S/Key or BSDAUTH were enabled in previous RPMs released by SuSE (i.e. the OpenSSH 2.9.9p2 RPMs previously released on March 6, and the OpenSSH 3.0.2p1 RPMs released with SuSE Linux 8.0). Support for interactive keyboard mode is compiled in, and is off by default in recent RPMs. However, it can be enabled by the administrator. Which means that, in the default configuration, SuSE Linux users are not affected by this vulnerability. We will release another set of RPMs that fix this vulnerability soon. -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBPRoAK3ey5gA9JdPZAQGPYwf+LM2z48HlQLHZBkKcKKjJPHyxVlK4JcFs vqyfcXTgXpjw1ja4NAZpYipMTCHC46IRVjiWHOxKTku2fyUjWe/w3/HdBnY7C51m Un2O7/LcxUrCLipnz6M8c+RzGoWbLQlne0Q8ohPkEcIIOIGBzVYQ+eHjKVY4QYDy +bCA/I+DhsS1QVmdgysNGWjuTd3oiUCYypb1ICLDhE2H0lD3su/HHzhJbFn+lT/a SKqlAwlYGcnL0+776gz1hx084uHKI29BvRaFDmtQ9MVbfDG/Tc/DqqtskPxtSsLL ZkvdPLyQOTjLxZkp7BBDH+1NSim+7t9xiYw8T2kYSsnRlZm8BreOlA== =LoIo -----END PGP SIGNATURE-----

1 0

Fwd: Much ado about nothing.
by Christoph Wegener 26 Jun '02

26 Jun '02

What about the SuSE OpenSSH builts concerning this advisory?!? Greetz Christoph ------- Start of forwarded message ------- From: Benjamin Krueger <benjamin(a)seattleFenix.net> To: freebsd-security(a)FreeBSD.ORG Subject: Fwd: Much ado about nothing. Date: 26.6.2002 16:23:26 http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584 Regards, -- Benjamin Krueger "Life is far too important a thing ever to talk seriously about." - Oscar Wilde (1854 - 1900) ---------------------------------------------------------------- Send mail w/ subject 'send public key' or query for (0x251A4B18) Fingerprint = A642 F299 C1C1 C828 F186 A851 CFF0 7711 251A 4B18 To Unsubscribe: send mail to majordomo(a)FreeBSD.org with "unsubscribe freebsd-security" in the body of the message -------- End of forwarded message --------

4 3

System Crash while scanned by nessus or saint
by Matthias Krauss 26 Jun '02

26 Jun '02

Hi List, i've a suse linux box (7.3 Kernel 2.4.16) which is dying without console messages while scanning from a foreign host with nessus or saint, the last log message points always to "can not execute finger ...", a tcpdump shows always different (last) messages, for testing i've stopped inetd, ssh, apache,smb and so on but the host still dies, des anybody have a idea wha this could be ? I made an kernel update from 2.4.10 to 2.4.16 but other hosts with the same setup and kernel doesnt have tha prob ?? many thanks Matthias

4 3

New OpenSSH - strange processlist
by Sven 'Darkman' Michels 26 Jun '02

26 Jun '02

Hi all, i noticed that 2 sshd's are running per login?! Szenario: no one logged in: 1 sshd (main) running. 1 user logged in: 1 sshd (main), 1 sshd (owner root), 1 sshd (owner user) running. 2 users logged in: 1 sshd (main), 2 sshd (owner root), 2 sshd (owner user) running. anybody knows why? afaik it wasn't so befor the update... Greetings, Sven

2 1

DETAILS for OpenSSH bug
by Christoph Wegener 26 Jun '02

26 Jun '02

FYI - Details of the OpenSSH bug can be found in: http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20584 Greetz Christoph -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:cwe@bph.ruhr-uni-bochum.de http://www.bph.ruhr-uni-bochum.de

1 0

RE: [suse-security] OpenSSH Vulnerability and Setting PrivilegeSeparation
by Ryan Swenson 26 Jun '02

26 Jun '02

Again I feel SuSE jumped ahead or in with a knee-jerk reaction to the alleged OpenBSD/OpenSSH exploit for SSH whose argument to this moment has been largely unfounded. Until they have produced enough documentation actually warning of the exploit and where exactly it does so, it has not even been made a CVE candidate, released in any official advisory except SuSE. The Developers of OpenSSH do not even have an answer themselves but to upgrade to 3.3 for a mere workaround whereas 3.3 has fundemental issues of its own. I would wait until its official before getting all too excited -perhaps look at http://online.securityfocus.com/advisories/4230 Ryan S. -----Original Message----- From: Simon Oliver [mailto:simon.oliver@umist.ac.uk] Sent: Wednesday, June 26, 2002 9:48 AM To: suse-security(a)suse.com Subject: [suse-security] OpenSSH Vulnerability and Setting PrivilegeSeparation > - They are asking all users to upgrade to version 3.3 (sic), > and enable the PrivilegeSeparation option. I have some machines running sshd V3 (not-SuSE distro). So I downloaded 3.3p1 from openssh - there are two configure options to set privsep options during compilation, but what values should I use? --with-privsep-path= --with-privsep-user= Can these be overidden / supplied in sshd_config or must it be done at compile time. Also, are there any unforseen (by me) side effects? -- Simon Oliver -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

AW: [suse-security] System Crash while scanned by nessus or saint
by Matthias Krauss 26 Jun '02

26 Jun '02

Thanks, the scan is a non dangerous / default options, same with saint, you're right, seems to be an important daemon but which one is it ??? ... will keep on searching ... M. -----Ursprüngliche Nachricht----- Von: Michael Haunzwickl [mailto:michael.haunzwickl@syn.at] Gesendet: Mittwoch, 26. Juni 2002 15:18 An: Matthias Krauss; Suse-Security Betreff: Re: [suse-security] System Crash while scanned by nessus or saint Hi there, have you allready check the Nessus Options? There is one point where you can say: "Include all plug-ins" or "Just -not dangerous- plug-ins" (or something like that) ... if you use the full options, Nessus also performs DoS Attacks, and maybe crashes one of your still running deamons. Seems to be an importent deamon ... if the box crashes down ... TheJackal ----- Original Message ----- From: "Matthias Krauss" <MKrauss(a)hitchhiker.com> To: "Suse-Security" <suse-security(a)suse.com> Sent: Wednesday, June 26, 2002 3:05 PM Subject: [suse-security] System Crash while scanned by nessus or saint > Hi List, > i've a suse linux box (7.3 Kernel 2.4.16) which is dying without console > messages > while scanning from a foreign host with nessus or saint, the last log > message points > always to "can not execute finger ...", a tcpdump shows always different > (last) messages, > for testing i've stopped inetd, ssh, apache,smb and so on but the host still > dies, > des anybody have a idea wha this could be ? I made an kernel update from > 2.4.10 to > 2.4.16 but other hosts with the same setup and kernel doesnt have tha prob > ?? > > many thanks > > Matthias > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > --- Ausgehende Mail ist zertifiziert virenfrei. Überprüft durch AVG Antivirus System (http://www.grisoft.com/de) Version: 6.0.371 / Virendatenbank: 206 - Erstellungsdatum: 13.06.2002

1 0