July 2002 - openSUSE Security - openSUSE Mailing Lists

iptables and 'manual' port forwarding on the fly?
by Mathias Homann 22 Jul '02

22 Jul '02

Hi, running susefirewall2, how can I just set one port to be forwarded to some port on some internal machine on the fly, and delete that port later, without rebooting the 'wall or restarting susefirewall? bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und §823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt!

2 1

FYI: PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1
by Sven 'Darkman' Michels 22 Jul '02

22 Jul '02

http://online.securityfocus.com/archive/1/283533/2002-07-19/2002-07-25/0 have "fun" ..

3 2

PHP Security Advisory
by Claus Lund 22 Jul '02

22 Jul '02

Copied from http://www.php.net/release_4_2_2.php Right now it's virtually impossible to get on to php.net to download the patch...but hopefully SuSE will have it some time soon. "PHP Security Advisory: Vulnerability in PHP versions 4.2.0 and 4.2.1 Issued on: July 22, 2002 Software: PHP versions 4.2.0 and 4.2.1 Platforms: All The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access. Description PHP contains code for intelligently parsing the headers of HTTP POST requests. The code is used to differentiate between variables and files sent by the user agent in a "multipart/form-data" request. This parser has insufficient input checking, leading to the vulnerability. The vulnerability is exploitable by anyone who can send HTTP POST requests to an affected web server. Both local and remote users, even from behind firewalls, may be able to gain privileged access. Impact Both local and remote users may exploit this vulnerability to compromise the web server and, under certain conditions, to gain privileged access. So far only the IA32 platform has been verified to be safe from the execution of arbitrary code. The vulnerability can still be used on IA32 to crash PHP and, in most cases, the web server. Solution The PHP Group has released a new PHP version, 4.2.2, which incorporates a fix for the vulnerability. All users of affected PHP versions are encouraged to upgrade to this latest version. The downloads web site at http://www.php.net/downloads.php has the new 4.2.2 source tarballs, Windows binaries and source patches from 4.2.0 and 4.2.1 available for download. Workaround If the PHP applications on an affected web server do not rely on HTTP POST input from user agents, it is often possible to deny POST requests on the web server. In the Apache web server, for example, this is possible with the following code included in the main configuration file or a top-level .htaccess file: <Limit POST> Order deny,allow Deny from all </Limit> Note that an existing configuration and/or .htaccess file may have parameters contradicting the example given above. Credits The PHP Group would like to thank Stefan Esser of e-matters GmbH for discovering this vulnerability." Claus Lund Department of Taxes Information Systems 109 State Street Montpelier, Vermont 05609 (802) 828-3735

1 1

squid always creates new cache directories at startup and crashes when shutting down
by mbauer＠in-sight.de 22 Jul '02

22 Jul '02

Hello list, got a problem with my squid (2.3) whenever I shut down squid, it gives me a warning that it has been killed. (not every time???) when I start squid ("rcsquid start") it always creates new cache directories. cache_dir ufs /cache 275 16 256 ....where /cache is a partition with 300MB. Squid runs without any problems (except this one :) The /var/log/squid7cache.log gives the following output: CPU Usage: 0.420 seconds = 0.230 user + 0.190 sys Maximum Resident Size: 0 KB Page faults with physical i/o: 315 Memory usage for squid via mallinfo(): total space in arena: 3802 KB Ordinary blocks: 3785 KB 4 blks Small blocks: 0 KB 0 blks Holding blocks: 692 KB 1 blks Free Small blocks: 0 KB Free Ordinary blocks: 17 KB Total in use: 4477 KB 118% Total free: 17 KB 0% 2002/07/22 10:36:42| Squid Cache (Version 2.3.STABLE4-hno.CVS): Exiting normally. 2002/07/22 10:36:46| Starting Squid Cache version 2.3.STABLE4-hno.CVS for i686-pc-linux-gnu... 2002/07/22 10:36:46| Process ID 22875 2002/07/22 10:36:46| With 4096 file descriptors available 2002/07/22 10:36:46| DNS Socket created on FD 2 2002/07/22 10:36:46| Adding nameserver 212.19.40.14 from /etc/resolv.conf 2002/07/22 10:36:46| Adding nameserver 212.19.48.14 from /etc/resolv.conf 2002/07/22 10:36:46| Unlinkd pipe opened on FD 7 I've checked the filepermissions, they're ok. there's also enough space on /cache. I run SuSE 7.2, SuSEFirewall 2 on a standard installation. Hope sbd can help me......... Thanks maX Bauer InSight Education GmbH 069 - 587098-90 mbauer(a)in-sight.de

2 1

Kazaa
by Thiego Xavier (MIU) 22 Jul '02

22 Jul '02

How I make stations to obtain them to locate the job of kazaa? Which formulates of Iptables has that to place? Thanks

2 1

php3 update for apache: failed dep
by ic_admin 22 Jul '02

22 Jul '02

Hi List, I try to install the new mod_php.rpm (for php v.3) which I found under 'http://www.suse.de/de/support/download/updates/70_i386.html' but I get the following error-message: "error: failed dependencies: apache_mmn_19990320_10 is needed by mod_php-3.0.17RC1-58" I'm running SuSE7.0 with the latest version of apache (1.3.19-115), mod_perl, mod_php and mod_ssl found on the update dir at SuSE. What can I do? Thanks and regards, Ruediger

2 1

Re: [suse-security] SuSE personal firewall in 7.3
by GentooRulez 22 Jul '02

22 Jul '02

>> As newbie and not well know in Linux I use SuSE 7.3 prof. with SuSE >> personal Firewall. From the, by me, well know Windows-os I use severall >> firewalls on different pc's. What strikes me is that I have on these >> Windows-machines allways a easy to read logfile of the firewall. > >Take a look at /etc/syslog.conf where you can see which logfiles are >configured for "sytem"-logs an your machine To be more precise and newbie compliant /var/log/messages logfile for system wide logging /var/log/firewall logfile for firewall specific logs >> This is >> something I cannot find on my Linux-machine. I went thru severall logfiles >> but cannot find anything that says something like : access denied, blocked, >> refused .... together with ip-addresses and so on. You have to set the level of logging in the configuration file of your firewall like this /etc/rc.config.d/firewall.rc.config FW_LOG_DENY_CRIT="yes" FW_LOG_DENY_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" to get detailed information on packets handled by your firewall rules. >> Is their any logfile kept by this personal firewall of SuSE 7.3 and is >> their, where to look exactly ? Is their also a way to filter out these >> info. /var/log/firewall contains the raw log info. To analyze there are several oss projects spread in the web. ask google for netfilter or iptables log analyzer and check for further information www.netfilter.org Yours Michael

1 0

Re: [suse-security] Deploy SuSE network infrastructure
by GentooRulez 22 Jul '02

22 Jul '02

>> Me would suggest, the check LDAP again. There are web interfaces for >> managing >> it and a lot of docs that describe the coop with samba and other services >> !!! To secure >> it check bugs on secorityfocus and so on. btw - what secure are the network >> transmissions >> in your windows network - ssl based ? :O) >> >> If you want to have a more fast solution without any work, try to click some >> services >> on w2k and look goes on ? :O) >> >> Yours >> >> Michael >> > >I'm deploy a ldap mail server, with samba integration, and web >autentication , but SuSE rpm not support ldap , must recompile. > >I've not find any usable web ldap manager sorry, can you tell me >someone?(I don't want webmin) > These guys wrote such a LDAP web frontend ftp://oss.gonicus.de/pub/gosa/ but i do not know whether there a english or even a italian version >P.S. any idea about YaST remote? > What kind of remote ? >What kind of user auth YaST-usermanager can manage? flat file only or >can manage NIS or kerberos? No idea - dont use yast for myself, but only for initial minimal installation. Michael

1 0

FreeS/WAN 1.98b-0.9.13 packages for SuSE Linux 8.0
by Christian Bjørnbak 22 Jul '02

22 Jul '02

Hi I'm trying to use Kurt Garloff's FreeS/WAN 1.98b-0.9.13 packages for SuSE Linux 8.0 from http://www.suse.de/~garloff/linux/FreeSWAN/ First I installed freeswan-1.98_0.9.13-3.i386.rpm without problems. Then I copied ipsec-2.4.18-4GB.o to /lib/modules/2.4.18-4GB/kernel/net/ipv4/ipsec.o, but after that I get a /lib/modules/2.4.18-4GB/kernel/net/ipv4/ipsec.o: unresolved symbol __out_of_line_bug trying to start the ipsec daemon. Then I installed the km_freeswan-1.98_0.9.13-3.i386.rpm to try and compile the kernel module myself.. But make -f Makefile.module returns the following error: IPsec not in kernel config (/usr/src/linux/.config)!!. I have been trying to "decipher" the Makefile to figure out what goes wrong. The IPSEC configs is correctly appended to .config but then .config is overridden again with default config... Have anyone experienced this/any solution for this?? /Christian Bjørnbak

1 0

Preliminary Apache updates
by Peter Poeml 20 Jul '02

20 Jul '02

Hi folks, if you are inclined, you could try preliminay Apache security update packages for the mod_ssl off-by-one buffer overflow at ftp://ftp.suse.com/pub/people/poeml/7.0/ ftp://ftp.suse.com/pub/people/poeml/7.1/ ftp://ftp.suse.com/pub/people/poeml/7.2/ ftp://ftp.suse.com/pub/people/poeml/7.3/ ftp://ftp.suse.com/pub/people/poeml/8.0/ Especially, you'll find the module packages as well. I'm saying "try them" because we have changed the dependency handling and did some clean up in the old packages, hoping to increase consistency. The apache packages now provide a cookie indicating the API version (which does not change with each apache release). I would appreciate any feedback, especially with regard to the package dependency issues. Please note: - The changelog is only in the source rpm. - No packages other than i386 right now. - Look for the timestamps, they coincide suspiciously with this mail. This command is helpful to determine the installed apache module packages: rpm -qa | egrep \ 'authldap|midgard|modcontr|apache-contrib|backhand|jserv|mod_(php|php4|python|perl|dav|ssl)' Thanks, Peter -- VFS: Busy inodes after unmount. Self-destruct in 5 seconds. Have a nice day...

1 0