June 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSE Security Announcement: OpenSSH (SuSE-SA:2002:023)
by Harald Nikolisin 25 Jun '02

25 Jun '02

you are right. It's the newer openssl rpm. thanks Am Dienstag, 25. Juni 2002 19:07 schrieb Daniele Frijia: > On Tue, Jun 25, 2002 at 06:50:29PM +0200, Harald Nikolisin wrote: > > the update with SuSE 7.1 (i386) does not work properly. > > > > ------------------- SNIP -------------------------- > > error: failed dependencies: > > libcrypto.so.0.9.6 is needed by openssh-3.3p1-6 > > ------------------------------------------------------- > > > > this missing file "libcrypto.so.0.9.6" is properly installed with the > > openssl rpm on this machine. > > Hast du das openssl-Update ( openssl-0.9.6a-42.i386.rpm ) eingespielt? > > Daniele -- Mit freundlichen Grüssen / With kind regards Dipl.-Ing. Harald Nikolisin SOFiSTiK AG (Entwicklung)

1 0

Firewall2 limiting services?
by David M. Collins 25 Jun '02

25 Jun '02

Sorry if this has been asked before (or is in a FAQ somewhere?). I currently run suse 7.3 and would like to limit some services to only our subnet. Currently, I have set in /etc/rc.config.d/firewall2.rc.config FW_DEV_EXT="eth0" FW_SERVICES_EXT_TCP="ssh ntp" I have a single computer with a single ethernet card pointing to the internet. Can I limit the ssh daemon to 18.x.x.x ?? David Collins

1 0

RE: RE: RE: [suse-security] Fwd: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known
by Alan Rouse 25 Jun '02

25 Jun '02

Thanks Peter. Just one more question: Do the patches for earlier versions (SuSE 7.x) also use the Apache 1.3.26 patch? Or Apache's back-porting of the fix? Or did SuSE have to backport the fix independently? Sorry to be a pain about this. My nervousness stems from the Apache team's comments indicating that backporting is complex and very risky. I just want to understand the risks I am taking. -----Original Message----- From: Peter Poeml [mailto:poeml@suse.de] Sent: Tuesday, June 25, 2002 9:13 AM To: Alan Rouse Subject: Re: RE: RE: [suse-security] Fwd: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known Hi Alan, On Tue, Jun 25, 2002 at 09:08:20AM -0400, Alan Rouse wrote: > If I missed some information I apologize. All I saw from SuSE was the > announcement found here: > > http://lists2.suse.com/archive/suse-security-announce/2002-Jun/0003.html > > According to that announcement, "On 32bit architectures, this overflow > cannot be exploited to inject code into the httpd process and gain > access to the machine". > > Despite the condescending replies I've received from some on this list, > I think my question is reasonable. I simply would like to hear from > SuSE whether or not you believe this patch addresses the remote access > threat which was disclosed after your patch was released. Ah, I see the point that you are asking about. Sure this is a fair request. There is some confusion about a patch released by the ISS. That patch was premature and not sufficient. The patch that Olaf added is one pulled from the cvs of the apache group and approved by them. The message of the second announcement of the apache group basically is "don't use the premature patch but ours". I hope it's clearer now. Don't hesitate to bug us further. Best wishes, Peter -- VFS: Busy inodes after unmount. Self-destruct in 5 seconds. Have a nice day...

1 0

RE: RE: [suse-security] Fwd: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known
by Alan Rouse 25 Jun '02

25 Jun '02

If I missed some information I apologize. All I saw from SuSE was the announcement found here: http://lists2.suse.com/archive/suse-security-announce/2002-Jun/0003.html According to that announcement, "On 32bit architectures, this overflow cannot be exploited to inject code into the httpd process and gain access to the machine". Despite the condescending replies I've received from some on this list, I think my question is reasonable. I simply would like to hear from SuSE whether or not you believe this patch addresses the remote access threat which was disclosed after your patch was released. -----Original Message----- From: Peter Poeml [mailto:poeml@suse.de] Sent: Monday, June 24, 2002 5:01 PM To: Alan Rouse Cc: suse-security(a)suse.com Subject: Re: RE: [suse-security] Fwd: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known On Mon, Jun 24, 2002 at 04:21:08PM -0400, Alan Rouse wrote: > >> Is another version coming soon? > > > > It's not the label of our package that matters -- but what's inside :) > > > >Peter > > And how are we supposed to know what is inside unless you tell us? If the information in the respective annoucement is not enough, or want to prove us wrong, you can download the source RPM and look into it, read the patch and so on. Of course, the amount of detail in the announcement could be subject of discussion. :^} By the way, just as a contrary effect a package might contain fixes that are not typically included in a given released version, such as fixes that are already in cvs but not in a certain release. Peter -- VFS: Busy inodes after unmount. Self-destruct in 5 seconds. Have a nice day...

2 1

Re: [suse-security-announce] OpenSSH Vulnerability
by Olaf Kirch 25 Jun '02

25 Jun '02

On Tue, Jun 25, 2002 at 11:35:50AM +0200, Michael Appeldorn wrote: > Works it too, even if you run sshd in daemon mode? Thought that it > will only be honored by tcp-wrapper. No, sshd calls hosts_access. > But in /etc/ssh/sshd_config you can find an equivalent option named > AllowHost. You have to pay some attention, if ipv6 is enabled. That > causes to notify even ipv4 addresses in ipv6 notation. This topic was > recently discussed right here. Yes, AllowHost should work too. Ths whole thing is just a question of where the vulnerability is; *before* it checks the client's IP or after. Probably after, but you never know. Olaf -- Olaf Kirch | Anyone who has had to work with X.509 has probably okir(a)suse.de | experienced what can best be described as ---------------+ ISO water torture. -- Peter Gutmann

1 0

Re: [suse-security] host.allow problem
by Erwin Zierler - stubainet.at 25 Jun '02

25 Jun '02

Shoshana Rosenthal wrote: > How??? > > Thanks > > Shoshana Umh... ok, try this: vi /etc/modules.conf search for the string ipv6 and you should get a line: alias net-pf-10 ipv6 Change it to: alias net-pf-10 off Reboot. Or if this is not an option try unloading ipv6 rmmod ipv6 But since yout eth0 or any other eths will be using this module you have to at least bring down your network with ifconfig eth0 down On SuSE boxes rcnetwork stop rmmod ipv6 rcnetwork start might be sufficient. If it doesnt help reboot ;-) I am not 100% sure but I think this is about it. HTH, Erwin --- > On Mon, 24 Jun 2002, Erwin Zierler - stubainet.at wrote: > >>The ::ffff: comes from IPv6 akaik, so if you dont need IPv6 yet (most >>of us probably don't) simply disable it. That should fix your problem. >> >>HTH, >> Erwin >> >>--- >>Shoshana Rosenthal wrote: >> >> >>>Hi, >>> >>>When using ssh to connect to another computer the software seems to add to >>>the IP address ::ffff: e.g. ::ffff:131.42.12.233 not just 131.42.12.233. >>>This causes the connection to be rejected by the remote hosts.allow >>>because there is a mismatch of IP address!= name . The remote hosts.allow >>>has the statements >>>ALL : UNKNOWN : DENY >>>ALL : PARANOID : DENY >>> >>>The simplest fix is to remove the UNKNOW and PARANOID checks, >>>which is not secure. >>> >>>I will appreciate any help. >>> >>>TIA >>>Shoshana Rosenthal >>>srosnethal(a)cfa.harvard.edu >>>

1 0

host.allow problem
by Shoshana Rosenthal 25 Jun '02

25 Jun '02

Hi, When using ssh to connect to another computer the software seems to add to the IP address ::ffff: e.g. ::ffff:131.42.12.233 not just 131.42.12.233. This causes the connection to be rejected by the remote hosts.allow because there is a mismatch of IP address!= name . The remote hosts.allow has the statements ALL : UNKNOWN : DENY ALL : PARANOID : DENY The simplest fix is to remove the UNKNOW and PARANOID checks, which is not secure. I will appreciate any help. TIA Shoshana Rosenthal srosnethal(a)cfa.harvard.edu

3 2

Fwd: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known
by JW 25 Jun '02

25 Jun '02

Seems that the version of Apache that SuSE just released (ftp://ftp.suse.com/pub/suse/i386/update/8.0/n2/apache-1.3.23-120.i386.rpm) must still be vulnerable: "The Apache Software Foundation has released versions 1.3.26 and 2.0.39 that address and fix this issue". Is another version coming soon? >Subject: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known >X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N > > > [[ Note: this issue affects both 32-bit and 64-bit platforms; the > subject of this message emphasizes 32-bit platforms since that > is the most important information not announced in our previous > advisory. ]] > > >SUPERSEDES: http://httpd.apache.org/info/security_bulletin_20020617.txt > >Date: June 20, 2002 >Product: Apache Web Server >Versions: Apache 1.3 all versions including 1.3.24; Apache 2.0 all versions >up to 2.0.36; Apache 1.2 all versions. > >CAN-2002-0392 (mitre.org) [CERT VU#944335] > >---------------------------------------------------------- > ------------UPDATED ADVISORY------------ >---------------------------------------------------------- >Introduction: > >While testing for Oracle vulnerabilities, Mark Litchfield discovered a >denial of service attack for Apache on Windows. Investigation by the >Apache Software Foundation showed that this issue has a wider scope, which >on some platforms results in a denial of service vulnerability, while on >some other platforms presents a potential remote exploit vulnerability. > >This follow-up to our earlier advisory is to warn of known-exploitable >conditions related to this vulnerability on both 64-bit platforms and >32-bit platforms alike. Though we previously reported that 32-bit >platforms were not remotely exploitable, it has since been proven by >Gobbles that certain conditions allowing exploitation do exist. > >Successful exploitation of this vulnerability can lead to the execution of >arbitrary code on the server with the permissions of the web server child >process. This can facilitate the further exploitation of vulnerabilities >unrelated to Apache on the local system, potentially allowing the intruder >root access. > >Note that early patches for this issue released by ISS and others do not >address its full scope. > >Due to the existence of exploits circulating in the wild for some platforms, >the risk is considered high. > >The Apache Software Foundation has released versions 1.3.26 and 2.0.39 >that address and fix this issue, and all users are urged to upgrade >immediately; updates can be downloaded from http://httpd.apache.org/ . > >As a reminder, we respectfully request that anyone who finds a potential >vulnerability in our software reports it to security(a)apache.org. > >---------------------------------------------------------- > >The full text of this advisory including additional details is available >at http://httpd.apache.org/info/security_bulletin_20020620.txt . ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com

6 11

Upcoming OpenSSH vulnerability
by Ralf Ronneburger 25 Jun '02

25 Jun '02

Hi everyone, I've read about this at the gentoo-security mailinglist and I've found the original mail at the openssh-unix-dev mailinglist, too. I fear that many of us will be affected by this... Best regards, Ralf Ronneburger > List: openssh-unix-dev > Subject: Re: Upcoming OpenSSH vulnerability > From: Markus Friedl <markus(a)openbsd.org> > Date: 2002-06-24 21:06:31 > [Download message RAW] > > On Mon, Jun 24, 2002 at 03:00:10PM -0600, Theo de Raadt wrote: >> Date: Mon, 24 Jun 2002 15:00:10 -0600 >> From: Theo de Raadt <deraadt(a)cvs.openbsd.org> >> Subject: Upcoming OpenSSH vulnerability >> To: bugtraq(a)securityfocus.com >> Cc: announce(a)openbsd.org >> Cc: dsi(a)iss.net >> Cc: misc(a)openbsd.org >> >> There is an upcoming OpenSSH vulnerability that we're working on with >> ISS. Details will be published early next week. >> >> However, I can say that when OpenSSH's sshd(8) is running with priv >> seperation, the bug cannot be exploited. >> >> OpenSSH 3.3p was released a few days ago, with various improvements >> but in particular, it significantly improves the Linux and Solaris >> support for priv sep. However, it is not yet perfect. Compression is >> disabled on some systems, and the many varieties of PAM are causing >> major headaches. >> >> However, everyone should update to OpenSSH 3.3 immediately, and enable >> priv seperation in their ssh daemons, by setting this in your >> /etc/ssh/sshd_config file: >> >> UsePrivilegeSeparation yes >> >> Depending on what your system is, privsep may break some ssh >> functionality. However, with privsep turned on, you are immune from >> at least one remote hole. Understand? >> >> 3.3 does not contain a fix for this upcoming bug. >> >> If priv seperation does not work on your operating system, you need to >> work with your vendor so that we get patches to make it work on your >> system. Our developers are swamped enough without trying to support >> the myriad of PAM and other issues which exist in various systems. >> You must call on your vendors to help us. >> >> Basically, OpenSSH sshd(8) is something like 27000 lines of code. A >> lot of that runs as root. But when UsePrivilegeSeparation is enabled, >> the daemon splits into two parts. A part containing about 2500 lines >> of code remains as root, and the rest of the code is shoved into a >> chroot-jail without any privs. This makes the daemon less vulnerable >> to attack. >> >> We've been trying to warn vendors about 3.3 and the need for privsep, >> but they really have not heeded our call for assistance. They have >> basically ignored us. Some, like Alan Cox, even went further stating >> that privsep was not being worked on because "Nobody provided any info >> which proves the problem, and many people dont trust you theo" and >> suggested I "might be feeding everyone a trojan" (I think I'll publish >> that letter -- it is just so funny). HP's representative was >> downright rude, but that is OK because Compaq is retiring him. Except >> for Solar Designer, I think none of them has helped the OpenSSH >> portable developers make privsep work better on their systems. >> Apparently Solar Designer is the only person who understands the need >> for this stuff. >> >> So, if vendors would JUMP and get it working better, and send us >> patches IMMEDIATELY, we can perhaps make a 3.3.1p release on Friday >> which supports these systems better. So send patches by Thursday >> night please. Then on Tuesday or Wednesday the complete bug report >> with patches (and exploits soon after I am sure) will hit BUGTRAQ. >> >> Let me repeat: even if the bug exists in a privsep'd sshd, it is not >> exploitable. Clearly we cannot yet publish what the bug is, or >> provide anyone with the real patch, but we can try to get maximum >> deployement of privsep, and therefore make it hurt less when the >> problem is published. >> >> So please push your vendor to get us maximally working privsep patches >> as soon as possible! >> >> We've given most vendors since Friday last week until Thursday to get >> privsep working well for you so that when the announcement comes out >> next week their customers are immunized. That is nearly a full week >> (but they have already wasted a weekend and a Monday). Really I think >> this is the best we can hope to do (this thing will eventually leak, >> at which point the details will be published). >> >> Customers can judge their vendors by how they respond to this issue. >> >> OpenBSD and NetBSD users should also update to OpenSSH 3.3 right away. >> On OpenBSD privsep works flawlessly, and I have reports that is also >> true on NetBSD. All other systems appear to have minor or major >> weaknesses when this code is running. >> >> (securityfocus postmaster; please post this through immediately, since >> i have bcc'd over 30 other places..) > _______________________________________________ > openssh-unix-dev(a)mindrot.org mailing list > http://www.mindrot.org/mailman/listinfo/openssh-unix-dev

3 2

RE: [suse-security] Fwd: [SECURITY] Remote exploit for 32-bit Apache HTTP Server known
by Alan Rouse 24 Jun '02

24 Jun '02

>> Is another version coming soon? > > It's not the label of our package that matters -- but what's inside :) > >Peter And how are we supposed to know what is inside unless you tell us?

3 2