July 2002 - openSUSE Security - openSUSE Mailing Lists

Bind9 & resolver libs
by andre 03 Jul '02

03 Jul '02

if set in resolv.conf to 127.0.0.1 and in named.conf recursion no; it should be fine ? afaik the problem is that querries on > bind8 is answered from the resolver libs and bind9 only answers from cache ? tia andre

1 0

Gobbles Apache Exploit
by Patrik Breitenmoser 03 Jul '02

03 Jul '02

Hi, I was just wondering if my patched apache on suse 7.3 is save against that exploit. regards Patrik

2 1

root-rechte
by rutger 03 Jul '02

03 Jul '02

hallo liste, wie kann man eine root-datei löschen, wenn sie nur lese und ausführen für root hat - also r-x------ . vielen dank, r.frechen

6 8

SuSE-SA:2002:023
by Alexander Schiftner 02 Jul '02

02 Jul '02

Hi! Can somenody explain why I can not find the rpms for i386 as described in the Security Announcement ? On ftp.suse.com I can only find ftp://ftp.suse.com/pub/suse/i386/update/7.3/sec1/openssh-2.9.9p2-102.i386.r… Thanx, Alex -------- Alexander Schiftner Support Austrosoft Weiss Datenverarbeitung GmbH Hietzinger Hauptstrasse 33 1130 Wien / Austria Phone: +43 - 1 - 8776205 - 17 Fax: +43 - 1 - 8776205 - 21 mailto:alexander.schiftner@austrosoft.at http://www.austrosoft.at

4 3

english list
by rutger 02 Jul '02

02 Jul '02

hello all, thanx for reminding me, that this is an english list. i forgot while thinking about the problem. sorry for the inconvenience, r.frechen

1 0

Apache upgrade from SuSE ?
by Felix Seeger 02 Jul '02

02 Jul '02

Hi I've downloaded an Apache update from SuSE. It is for SuSE Linux 7.0. The version of apache is 1.3.19. Is this the right version against the new apache worm ? Apachetoday.com means that I have to upgrade to 1.3.26 but there is only a package for 8.0. Is this a special SuSE patched version ? thanks have fun Felix

6 7

OpenSSH
by christian.burri＠synecta.ch 02 Jul '02

02 Jul '02

Hi list, I have a SuSE 7.3 box here, and after updating sshd via YOU, something weird happened. It seemed so weird to me that I decided to post it here. The 7.3 box is a firewall, it links three seperate networks to the internet. My home LAN is one of these networks, I have to add. Now that I updated the box, it locked up pretty soon with an Oops message. I restarted it and it seemed to work fine, Therefore, I went home after a while and got a bit on IRC and texted wif some of my friends when suddenly my session would disconnect. Well, the uplink to the ISP is kinda "OEM" ADSL, it is provided by our national telco to the ISP, which in turn resells the connection to us, thus the ISP doesnt have to run lines down to every building in the country. So far so good, this line is quite the crap when compared to a real leased line, it goes down alot for short moments etc; they blame it on capacity problems. Thus I tought the line would be just down due to "normal behaviour" and come back up after a short while. But this wasnt so. The line was down, and it didnt look like it would come back up by itself. So I went to my other connection (cable) and tried to ping the traceroute to my inner firewall. The result was that the packets stopped at mentioned suse 7.3 box. Therefore I tried to ping the machine, to no avail. I also tried logging in via SSH, that didnt work either. So I assumed that the box would simply have Oops'd again. I couldnt login to it, neither from my LAN side, nor from the internet side, and it didnt even reply to pings. But suddenly... I noticed, while being on the computer with the cable connection, that I was still logged in to my webserver box, that is attached to the same LAN as my workstation is (where I irc'd from) ! Now what the fsck?? It was definately responsive, I could type commands and it gave me output. So I tried to establish another SSH session, which wouldnt work either! Now, as if this werent strange enough, I logged in to the inner firewall from the webserver box, also via ssh, and tried to login to said suse 7.3 firewall from the inner firewall (which has a connection to the suse 7.3 firewall via SDSL). And that worked. The box that didnt reply to pings, nor route my traffic from the LAN to the internet or vice versa, it gave me a login prompt. So I logged on, and looked at logs, but there was nothing unusual, no suspicious messages or anything. I looked at route -n and also at netstat -a and nothing appeared to be wrong. So I did rcnetwork restart. And all of a sudden, my connectivity was restored, IRC reconnected etc. Very very very very weird. I might add that such things never happened before I updated sshd. Cheers Chris Burri .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^

4 3

Re: AW: [suse-security] root-rechte
by Stefan Nowak 02 Jul '02

02 Jul '02

Maybe he was astonished deleting a file of root with a non-root account... sag@integra:/tmp/rmtest > ls -al Gesamt 32 drwxr-xr-x 2 sag other 178 Jul 2 18:10 . drwxrwxrwt 9 root sys 1821 Jul 2 18:10 .. -r-x------ 1 root root 0 Jul 2 18:10 test sag@integra:/tmp/rmtest > rm test rm: test: Schutz 500 (yes/no) übergehen? y sag@integra:/tmp/rmtest > ls -al Gesamt 32 drwxr-xr-x 2 sag other 117 Jul 2 18:11 . drwxrwxrwt 9 root sys 1821 Jul 2 18:10 .. Greetings, Stefan Cristian Ion schrieb: > > Hi! > > su - > rm -f $file > > or > > su - > chmod 700 $file > rm $file > > or ... > > etc, etc, etc. > > Sure, if you're root on the box... > > Or did I understand something else? > > Cristian > > > > > rutger schrieb: > > > > > > hallo liste, > > > > > > wie kann man eine root-datei löschen, wenn sie > > > nur lese und ausführen für root hat - also r-x------ . > > > vielen dank, r.frechen > > > > > > > Hi Schreiber, > > > > Mit rm wenn Du schreibrechte für das Verzeichnis hast, in dem > > die Datei > > liegt. Oder habe ich die Frage absolut falsch verstanden?! Verstehe > > nämlich den Zusammenhang nicht... ? > > > > Grüße, > > > > Stefan Nowak > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > -- Stefan Nowak Dipl.-Ing. (BA) Technologieberater SAG Systemhaus GmbH Alt-Moabit 96, D-10559 Berlin Telefon +49-30-390 903-206, Fax -250

1 0

UDP security
by Pacifico Chavez 02 Jul '02

02 Jul '02

Hi!! I'm Getting messages like in log: kernel: UDP: short packet: 556/548 other numbers also frequently show up: 0/141 1900/141 What could this be? Thank you for your assistance ----------------------------------------------------------- Pacifico ----------------------------------------------------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

apache chroot
by Patrik Breitenmoser 02 Jul '02

02 Jul '02

Hi all, after jailing my bind installation, ist there a howto how to chroot the apache webserver? Any link would be great. thanks patrik

2 1