June 2002 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 suddenly stopped working and started behaving strangely
by Rainer Hofmeister 21 Jun '02

21 Jun '02

System: SuSE 8.0, all the patches as per 20.6.2002. Firewall with internal,external,DMZ. Everything over Ethernet. After a few days without any problems the system stopped during reboot at the second stage of firewall initialization. It just hangs there for a long time. When you do Ctrl+Alt+Del you see a part of the firewall log for a few seconds before the system goes down for reboot. None of the logs show anything strange. I started the firewall manually. At stage 2 something strange happended. After issuing the SuSEfirewall2_setup start command the midnight-commander pops up and shows the /var/log directory! After I closed mc I saw a "less" of the /var/log/firewall file! Can anybody explain this strange behaviour? I removed the /sbin/SuSEfirewall2 file manually and reinstalled the package from CD. It works now but I fear that the strange behaviour will re-surface. Regards, Rainer

1 0

Beware of patch fetchmail-831
by Rainer Hofmeister 21 Jun '02

21 Jun '02

I've found some serious problems in the patch fetchmail-831 which I got over YOU (SuSE 8.0): 1) Postmaster option doesn't work with virtual domains anymore. A mail sent to an unknown account in the "main" domain of the server gets sent to postmaster correctly. Sent to an unknown account under one of the virtual domains it justs remains on the POP server (not flushed). Maybe this isn't a bug but a new feature. 2) On a slower line I got the dreaded "error while fetching.... SOCKET" errors. Going back to the old fetchmail delivered with 8.0 solved the problems. -Rainer

1 0

pptp security VPN
by Ricardo Javier Aranibar León 21 Jun '02

21 Jun '02

Hi List, Somebody knows how I can connect client pptp linux SuSE to server ppp in Windows but not using modem (interface ppp), because I have only interface eth0 and I like use this interface, this is connect to the switch and router, my connection is 128kbs and I don't need install modem for have interface ppp. If somebody can help me I will thankfull.. _________________________________________________________________ Únase con MSN Hotmail al servicio de correo electrónico más grande del mundo. http://www.hotmail.com

1 0

More than one dns-based spam filters with sendmail?
by Thorsten Marquardt 21 Jun '02

21 Jun '02

Dear List, currently I ask ordb.org whether mail comes from an open relay. But this covers not all the known spam-sources. So it would be nice to have one or two other dns-based relay checks in my sendmail rules. So I have FEATURE(`dnsbl',`relays.ordb.org',`Rejected - see http://ordb.org/')dnl FEATURE(`dnsbl',`blackwholes.wirehup.net',`Rejected - see http://domea.wirehup.nl/error/erros.html')dnl set in the mc-file, I generate the sendmail.cf from. But It seems that sendmail only asks the first dns server and if this states the relay as "not known as an open relay" it accepts the connection. How do I get sendmail to do more relay checks? Thanks in advance Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

4 7

SuSE box in windoze LAN?
by Mikhail 21 Jun '02

21 Jun '02

Hello everybody, Can anybody please tell me which ports should I open in my SuSE box in order to be able to browse Windoze LAN (e.g., with LinNeighborhood)? Thanks in advance! -- Best regards, Mikhail (mailto:muxaul@lenta.ru) 21.06.2002, 11:50

2 1

RE: [suse-security] SuSE Apache patch sufficient?
by Alan Rouse 20 Jun '02

20 Jun '02

Jeremy wrote: > The DoS is caused by a buffer overflow that kills the child process, > forcing the parent httpd process to spawn a new child. This spawing > requires resources, which is your DoS. According to what I've read, > that buffer overflow is the same one that some are now using to gain > root access. So if the overflow is fixed, the DoS and remote root are > fixed. That is my understanding as well. I'm just trying to resolve that "if". The two exerpts below are taken from posts by Cliff Woolley on Yahoo Groups new-httpd. He appears to be directly involved in creating the Apache fixes... Both posts imply that it is risky to try to migrate the patch from 1.3.26 to the earlier versions. The second post indicates that ISS only addressed the erroneous code in one place, leaving multiple instances of the problem unaddressed. Given that SuSE had an incomplete picture of the problem when they were (apparently) backporting the Apache fixes for the SuSE 7.x patches, I wonder whether they have also left some instances unpatched. A simple statement on this subject from SuSE might go a long way toward easing my concerns.... ======================================================================== Exerpt from first post ======================================================================== > As far as I understand, the changes included backporting chunked > encoding handling (http_protocol.c: 1.316 -> 1.317), and using > ap_strtol() instead of strtol(). Is that all? I need this because I > would just like to apply this fix to my local apache source tree, which > is version 1.3.20. No, there's much more to it than that. Several patches went in to several files, including http_protocol.c and several files in the proxy, possibly others. Anyway, it's much safer just to upgrade to 1.3.26. --Cliff ======================================================================== = Exerpt from second post ======================================================================== = > 1) My first question is why patch wrote by ISS doesn't correct this bug ? Because they only casted the value in one place, but type conversions happen on that value in other places as well. > 2) My second : how could I correct my proxy apache, is there a patch to > correct this bug ? Or have I to re-install apache with the 1.3.26 > distribution. The safest thing by far is to upgrade to 1.3.26, which includes a patch for the proxy as well as for the core for this issue. --Cliff

1 0

RE: [suse-security] SuSE Apache patch sufficient?
by Alan Rouse 20 Jun '02

20 Jun '02

> So, why should they bring out a fixed version, if there were not a > _potential_ exploit? Remote root will not be, because apache doesn't run > as root, but wwwrun might be. I don't see the point of this discussion. > There was a bug, there is a fix. SuSE did a great and fast job. SuSE did not claim to have fixed a remote root exploit. They claimed to have fixed a DDOS. They specifically stated that the bug they addressed could not be used to inject code and gain access to the machine. That doesn't make me very confident that their patch addresses the newly disclosed problem (which specifically DOES inject code and gain access to the machine).

2 1

OpenSSH 3.0.2p1
by James Ogley 20 Jun '02

20 Jun '02

Hi, I'm running SuSE 8.0, with OpenSSH 3.0.2p1-108. This morning, I did a Nessus scan on one of my boxen at home, which reported that this version is vulnerable to the off-by-one hole. I checked the Security Announcement about this (SuSE-SA:2002:009), but this predates 8.0, and refers to fixed versions of 2.9.9. Is the package of 3.0.2p2 in 8.0 patched to fix this hole as well, thus rendering that aspect of my Nessus report a red herring? If not, is there an update in the works? Cheers James -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Using Free Software since 1994, running GNU/Linux (SuSE 8.0) Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org ********************************************************************** CONFIDENTIALITY.This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance plc. If you have received this email in error please immediately notify the Pinnacle Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

3 2

RE: [suse-security] SuSE Apache patch sufficient?
by Alan Rouse 20 Jun '02

20 Jun '02

>> So either they are bluffing or the eploit does exist. I prefer not to >> assume the former. And I don't exactly consider these folks a trusted >> third party. > > you're right - this also confused me. I guess they are bluffing... > So I tried it against different systems and it did'nt work. The comments imply that there is a different exploit for each OS (different "peculiarity" in each one makes it possible) and they only released the one for OpenBSD. Even Apache seems to have believed that it was not exploitable on 32 bit *nix. They are recommending upgrading to 1.3.26, which they say corrects the "core" problem. Hopefully they are right. Since the Linux exploit has not been published it's hard to know whether this fixes the problem... but if it is sufficient against the published OpenBSD exploit then I guess we have to go with that. However, I'm patching SuSE 7.0, 7.1, and 7.2. I guess I'm not going to get exactly 1.3.26 from SuSE for these. So I'd really like some sort of statement from SuSE indicating whether or not the potential remote root issue on my system will be addressed by their patch.

2 1

SuSE Apache patch sufficient?
by Alan Rouse 20 Jun '02

20 Jun '02

Yesterday's SuSE advisory (Apache chunk handling) indicates their belief that: On 32bit architectures, this overflow cannot be exploited to inject code into the httpd process and gain access to the machine, because the overflow will always result in a segmentation fault, and the process will terminate. However, the exploit posted this morning on vulnwatch indicates that such an exploit exists against Linux. This makes me wonder whether the SuSE patch is sufficient. (If they did not fully understand the threat, have they actually addressed it?) What is the official SuSE answer to this question? Thank you.

2 1