June 2002 - openSUSE Security - openSUSE Mailing Lists

scanlogd
by Oliver Block 19 Jun '02

19 Jun '02

Hi, why would scanlogd not alert when I scan the computer with saint from another host? syslog-entry is: <syslog.conf> daemon.alert /var/log/scanlog daemon.alert /dev/tty11 </syslog.conf> Both, scanlogd and syslogd are running. I got a kernel-massage <messages> ... kernel: scanlogd uses obsolete (PF_INET,SOCK_PAKET) ... </messages> but that should not cause the problem, correct? tia, Oliver Block __________________________________________________________________ Gesendet von Yahoo! Mail - http://mail.yahoo.de Yahoo! präsentiert als offizieller Sponsor das Fußball-Highlight des Jahres: - http://www.FIFAworldcup.com

2 1

Re: [suse-security] Strange UDP packets
by BLeonhardt＠analytek.de 18 Jun '02

18 Jun '02

... I guess it's the port for "klisa" ... check with "lsof -ni" Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Jochen Lillich <jl(a)teamlinux.de> 18.06.02 15:06 An: suse-security(a)suse.com Kopie: Thema: [suse-security] Strange UDP packets Hi, on a firewall test system with newly installed iptables packet filter, I get the following log entries: Jun 18 11:38:48 lnxsrv2 kernel: RULE 9 -- Deny IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:60:67:78:2e:37:08:00 SRC=192.168.1.12 DST=255.255.255.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32769 DPT=7741 LEN=24 Jun 18 11:38:48 lnxsrv2 kernel: RULE 9 -- Deny IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:60:67:78:2e:37:08:00 SRC=192.168.1.12 DST=255.255.255.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32769 DPT=7741 LEN=24 The source host is an internal work PC, the internal net is DHCP based. What could be the source of these UDP packets? DHCP? DNS? Any clues? Best regards, Jochen -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Strange UDP packets
by Jochen Lillich 18 Jun '02

18 Jun '02

Hi, on a firewall test system with newly installed iptables packet filter, I get the following log entries: Jun 18 11:38:48 lnxsrv2 kernel: RULE 9 -- Deny IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:60:67:78:2e:37:08:00 SRC=192.168.1.12 DST=255.255.255.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32769 DPT=7741 LEN=24 Jun 18 11:38:48 lnxsrv2 kernel: RULE 9 -- Deny IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:60:67:78:2e:37:08:00 SRC=192.168.1.12 DST=255.255.255.255 LEN=44 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=32769 DPT=7741 LEN=24 The source host is an internal work PC, the internal net is DHCP based. What could be the source of these UDP packets? DHCP? DNS? Any clues? Best regards, Jochen

1 0

Re: [suse-security] Apache update
by bliss＠attbi.com 18 Jun '02

18 Jun '02

I am not certain if this is the exploit you are talking about. There was no link included in the email which you sent. But, the XForce email announcing an exploit (assumed to be what you are talking about here, specifically states: > > X-Force has verified that this issue is exploitable on Apache for > > Windows (Win32) version 1.3.24. Apache 1.x for Unix contains the same > > source code, but X-Force believes that successful exploitation on most > > Unix platforms is unlikely. So, if this is the vulnerability which you are talking about, then the reporting group states that it is probably not a problem on Unix (which would include SuSE Linux). Jim > There is an issue with apache, corroborated by the apache > guys, > with a story at /. > > Short version: > Are we waiting for the apache team to come up with a patch, > or do you guys have an idea of a fix? Is this remotely > exploitable, or just a dos with apache 1.3.x? > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

4 3

Re: [suse-security] Apache update
by ts 18 Jun '02

18 Jun '02

> * bliss(a)attbi.com wrote on Tue, Jun 18, 2002 at 04:26 > +0000: > > I am not certain if this is the exploit you are talking > > about. There was no link included in the email which > you > > sent. No, sorry bout that. I did mention the slashdot story however, which is still in the "current" queue. But, the XForce email announcing an exploit > > (assumed to be what you are talking about here, > > specifically states: > > > > > > X-Force has verified that this issue is exploitable > > > > on Apache for > > > > Windows (Win32) version 1.3.24. Apache 1.x for Unix > > > > contains the same > > > > source code, but X-Force believes that successful > > > > exploitation on most > > > > Unix platforms is unlikely. > > > > So, if this is the vulnerability which you are talking > > about, then the reporting group states that it is > > probably not a problem on Unix (which would include SuSE > > Linux). > > Well, in the Apache group's advisory, Mark J Cox stated it > a > little different and said the patch supplied by IIS > wouldn't > prevent it. That is also what I have read. In either case, the flaw, if viable for SuSE linux distributed versions, still seems to have the possibility of killing child instances. This means forking() another eventually. A possible denial of service is much better than the alternative here though. Hope this is all there is to it.

1 0

firewall messages.... what is goin on?
by PR 17 Jun '02

17 Jun '02

it has been asked before, I guess, but please be gentle, following messages appeared: can someone fill me in?? piet Jun 17 05:47:36 photoserver kernel: martian source 213.17.34.12 from 192.168.0.5, on dev ppp0 Jun 17 05:47:36 photoserver kernel: ll header: 45:00:00:4e Jun 17 05:47:36 photoserver kernel: SuSE-FW-DROP-DEFAULTIN=ppp0 OUT= MAC= SRC=213.22.197.144 DST=213.17.34.12 LEN=78 TOS=0x00 PREC=0x00 TTL=113 ID=16403 PROTO=UDP SPT=137 DPT=137 LEN=58 Jun 17 05:47:37 photoserver kernel: martian source 213.17.34.12 from 192.168.0.5, on dev ppp0 Jun 17 05:47:37 photoserver kernel: ll header: 45:00:00:4e Jun 17 05:47:37 photoserver kernel: SuSE-FW-DROP-DEFAULTIN=ppp0 OUT= MAC= SRC=213.22.197.144 DST=213.17.34.12 LEN=78 TOS=0x00 PREC=0x00 TTL=113 ID=19731 PROTO=UDP SPT=137 DPT=137 LEN=58 Jun 17 05:47:39 photoserver kernel: martian source 213.17.34.12 from 192.168.0.5, on dev ppp0 Jun 17 05:47:39 photoserver kernel: ll header: 45:00:00:4e Jun 17 20:57:58 photoserver kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 OUT=eth1 SRC=195.96.96.97 DST=192.168.0.4 LEN=126 TOS=0x00 PREC=0x00 TTL=248 ID=22226 DF PROTO=UDP SPT=53 DPT=137 LEN=106 Jun 17 20:57:59 photoserver kernel: SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=217.134.38.159 DST=213.17.31.215 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=9490 DF PROTO=TCP SPT=1222 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204021801010402) Jun 17 20:57:59 photoserver kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 OUT=eth1 SRC=195.96.96.136 DST=192.168.0.4 LEN=40 TOS=0x00 PREC=0x00 TTL=248 ID=21057 PROTO=TCP SPT=110 DPT=1074 WINDOW=0 RES=0x00 RST URGP=0 Jun 17 20:58:00 photoserver kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.0.4 DST=195.96.96.33 LEN=73 TOS=0x00 PREC=0x00 TTL=127 ID=17155 PROTO=UDP SPT=137 DPT=53 LEN=53 Jun 17 20:58:01 photoserver kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.0.4 DST=195.96.96.136 LEN=40 TOS=0x00 PREC=0x00 TTL=127 ID=17411 DF PROTO=TCP SPT=1074 DPT=110 WINDOW=8387 RES=0x00 ACK FIN URGP=0 Jun 17 20:58:01 photoserver kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.0.4 DST=195.96.96.33 LEN=73 TOS=0x00 PREC=0x00 TTL=127 ID=17667 PROTO=UDP SPT=137 DPT=53 LEN=53

2 1

Re: [suse-security] firewall messages.... what is goin on?
by PR 17 Jun '02

17 Jun '02

thanks for the prompt respons: the thing is there is ... or was nothing wrong for month: I don't have 192.168.0.5 my ports are scanned intensly and the firewall lists are endless... on top of that strange phantom nics appeared, I mailed that earlier in this group. By now I have screen shots of that (control centre-nic's in kde 3) I don't want to cry wolve but something strange is happening. What kind of info do you need? piet Armin Schöch wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Hi Piet ! > >Probably you can find the answer when looking for the keywords >"martian source" with Google or any other search engine. > >>Jun 17 05:47:36 photoserver kernel: martian source 213.17.34.12 from >>192.168.0.5, on dev ppp0 >>Jun 17 05:47:36 photoserver kernel: ll header: 45:00:00:4e >>Jun 17 05:47:36 photoserver kernel: SuSE-FW-DROP-DEFAULTIN=ppp0 OUT= MAC= >>SRC=213.22.197.144 DST=213.17.34.12 LEN=78 TOS=0x00 PREC=0x00 TTL=113 >>ID=16403 PROTO=UDP SPT=137 DPT=137 LEN=58 >> > >There is a paket coming from your dial-up interface ppp0 with the >source address 213.22.197.144 go port 137 (netbios-ns) of your >machine. "Martian source" means that the packet is coming from the >wrong interface. This is a sign that there is something misconfigured >in the network either at your routing or at any other PC in your >network neighbourhood. > >>Jun 17 05:47:37 photoserver kernel: martian source 213.17.34.12 from >>192.168.0.5, on dev ppp0 >> > >The packet with source IP 213.17.34.12 is coming from your interface >ppp0 with IP 192.168.0.5. But this is a private subnet where only >source IPs of 192.168. are allowed. Therefore it's a martian source. > >>Jun 17 05:47:37 photoserver kernel: ll header: 45:00:00:4e >> >- --> This seems to be a ping packet (ICMP echo request). > >>Jun 17 05:47:37 photoserver kernel: SuSE-FW-DROP-DEFAULTIN=ppp0 OUT= MAC= >>SRC=213.22.197.144 DST=213.17.34.12 LEN=78 TOS=0x00 PREC=0x00 TTL=113 >>ID=19731 PROTO=UDP SPT=137 DPT=137 LEN=58 >>Jun 17 05:47:39 photoserver kernel: martian source 213.17.34.12 from >>192.168.0.5, on dev ppp0 >>Jun 17 05:47:39 photoserver kernel: ll header: 45:00:00:4e >>Jun 17 20:57:58 photoserver kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 >>OUT=eth1 SRC=195.96.96.97 DST=192.168.0.4 LEN=126 TOS=0x00 PREC=0x00 >>TTL=248 ID=22226 DF PROTO=UDP SPT=53 DPT=137 LEN=106 >> > >Obviously there is more unallowed routing going on. You should provice >more details about your network setup so we have a better chance of >understanding the problem. > >HTH, >Armin > >- -- >Am Hasenberg 26 office: Institut für Atmosphärenphysik >D-18209 Bad Doberan Schloss-Straße 6 >Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY >Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 >WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: Weitere Infos: siehe http://www.gnupg.org > >iD8DBQE9DkpIG8Xv4GxznLoRAjqrAKCgwctW19eT6ZRtc5IfqVsrj9NTiQCg1jPu >PoOnsaFgZ0VzxPnDbuVRZnI= >=EASV >-----END PGP SIGNATURE----- > > > >

1 0

firewall message... what does it mean...
by pr 17 Jun '02

17 Jun '02

the following message was listed, can someone fill me in? piet Jun 17 05:47:36 photoserver kernel: martian source 213.17.34.12 from 192.168.0.5, on dev ppp0 Jun 17 05:47:36 photoserver kernel: ll header: 45:00:00:4e Jun 17 05:47:36 photoserver kernel: SuSE-FW-DROP-DEFAULTIN=ppp0 OUT= MAC= SRC=213.22.197.144 DST=213.17.34.12 LEN=78 TOS=0x00 PREC=0x00 TTL=113 ID=16403 PROTO=UDP SPT=137 DPT=137 LEN=58 Jun 17 05:47:37 photoserver kernel: martian source 213.17.34.12 from 192.168.0.5, on dev ppp0 Jun 17 05:47:37 photoserver kernel: ll header: 45:00:00:4e Jun 17 05:47:37 photoserver kernel: SuSE-FW-DROP-DEFAULTIN=ppp0 OUT= MAC= SRC=213.22.197.144 DST=213.17.34.12 LEN=78 TOS=0x00 PREC=0x00 TTL=113 ID=19731 PROTO=UDP SPT=137 DPT=137 LEN=58 Jun 17 05:47:39 photoserver kernel: martian source 213.17.34.12 from 192.168.0.5, on dev ppp0 Jun 17 05:47:39 photoserver kernel: ll header: 45:00:00:4e

1 0

[suse-security] ucdsnmp setup
by Olson, John C 17 Jun '02

17 Jun '02

Hello, As a relative SNMP newbie, would appreciate any sample config's for ucdsnmp in a secure setup (community strings set, no write access, binding to a particular address/port, etc). I would like for our OpenView Monitor to be able to have read only access to all the various system state information (interface table, etc). Any help is appreciated. > Thanks, > John

1 0

unknown network interface appear
by PR 17 Jun '02

17 Jun '02

an unknown network interface showed up with an unfamiliar ip-address at my box. is it possible someone sneaked in my box, though susefirewall2 is on? or was it a temp flaw in kde3 (controlcenter/information/network interface) piet

3 2