September 2002 - openSUSE Security - openSUSE Mailing Lists

Update SuSE 7.0
by Andre ten Bohmer (WUR) 24 Sep '02

24 Sep '02

Hello, I don't hope it is OT, but is there quick way to update a Pc with the SuSE 7.0 distro installed? We have found a Pc with this distro, but it lacks lots off patches. Yast2 does not have the on-line update option, so is the only option (except upgrading to 7.3/8.0 ) to manually update all relevant rpm's? TIA, Andre

6 5

SuSEfirewall2 + RIP server + CUPS
by Harald Steden 24 Sep '02

24 Sep '02

Hello together! Found no ansewer to following question yet: My workstation (SuSE 8.0, 2.4.19) is connected to the www via ppp and to a local network via eth0. I use the SuSEfirewall2 on my workstation. I configured the firewall with yast so that the workstation is not protected against internal network. In the local network there is a RIP server running CUPS 1.1.15. The printers are visible for a short time, when I stop the firewall. But after a while I cannot see them anymore. The CUPS server broadcasts information about his available printers to the local network. I added following to the firewallscript: iptables -A INPUT -i eth0 -s 192.168.0.0 -d 192.168.0.0 -j ACCEPT But the same behavior. My knowlegde about firewalls is not the best. Can someone help me giving a hint? Thanks for your trouble. Harald

1 0

[OT] www.openssl.org offline?
by Hans-Peter Jansen 23 Sep '02

23 Sep '02

Here I get: Beim Laden von http://www.openssl.org/ ist folgender Fehler aufgetreten: Zeitüberschreitung auf dem Server Zeitüberschreitung beim Warten auf www.openssl.org ping www.openssl.org is ok. Any ideas anybody? hp

3 2

RE: [suse-security] Linux/Slapper.worm
by bliss＠attbi.com 23 Sep '02

23 Sep '02

The answer is a simple YES. By the way, there is no guessing about it. The note in advisory CA-2002-27 includes the statement: The Apache/mod_ssl worm is self-propagating malicious code that exploits the OpenSSL vulnerability described in VU#102795. This vulnerability was the among the topics discussed in CA-2002-23 Multiple Vulnerabilities In OpenSSL. The SuSE announcement for SSL says it fixes the bug in CA-2002-23. Therefore, these are the correct patches and THERE IS NO GUESSING about it. Sorry, but these email were really dragging out for no good reason if the announcements were properly read. Jim > Miguel Albuquerque wrote: > > Slapper is using an OpenSSL mod_ssl exploit reported and patched at > > http://www.openssl.org/news/secadv_20020730.txt. > > > > The security update openssl release 20020812 by SuSE fixes the > > problem? Thanx > > Olaf replied: > > It does. > > > > Olaf > > I want to be absolutely sure I know what I'm doing here. > > The only recent ssl-related advisories I see in the SuSE archive are > these: > > July 30: > http://lists2.suse.com/archive/suse-security-announce/2002-Jul/0003.html > July 31: > http://lists2.suse.com/archive/suse-security-announce/2002-Jul/0004.html > > The July 30 advisory provides links to openssl rpms that appear, based > on the names, to range from 0.9.5a to 9.9.6e, depending on which level > of SuSE you are on. The CERT advisory says you need 0.9.6e or newer. > Now I know SuSE often patches old versions to simplify dependency > implications. But I don't want to make a bad assumption here. So I am > looking for definitive information: > > The CERT advisory for slapper: > > http://www.cert.org/advisories/CA-2002-27.html > > says that slapper exploits vulnerability VU#102795: > > http://www.kb.cert.org/vuls/id/102795 > > which labels this vulnerability as CERT Advisory CA-2002-23, and CVE > Name CAN-2002-0656. This matches one of the cross-referenced > vulnerabilities on the SuSE July 30 advisory: > > > http://lists2.suse.com/archive/suse-security-announce/2002-Jul/0003.html > > Based on this, my guess (I hate having to guess about this!) is that all > of the rpm's linked in the July 30 advisory have been patched by SuSE > and contain the fix needed to overcome the vulnerability (VU#102795) > exploited by slapper, despite the confusing names of those openssl > versions. Therefore, applying the listed rpm designated for my version > of SuSE will protect me from the slapper worm. Is this correct? > > Many thanks for your excellent work in fixing these things. > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

13 16

Re: [suse-security] Slapper worm type B
by Thomas Lamy 23 Sep '02

23 Sep '02

> Hi all, > > does the last openSSL fix the slapper.B worm ? > > ---quoting ISS security advice--- > > Internet Security Systems Security Brief > September 22, 2002 > > Propagation of "Slapper" OpenSSL/Apache Worm Variant > > [...] > > Both versions carry the > same attack > payload and attempt to exploit a previously disclosed > vulnerability in the > Secure Sockets Layer 2.0 (SSLv2) handshake process. > > [...] > As both variants use the same attack, you should be safe if you follow the directions in http://www.suse.com/de/security/2002_027_openssl.html . Olaf Kirch sent out a clarification SA last week: http://www.suse.com/de/security/2002_033_openssl.html Thomas

1 0

Slapper worm type B
by Fabrizio Di Meo 23 Sep '02

23 Sep '02

Hi all, does the last openSSL fix the slapper.B worm ? ---quoting ISS security advice--- Internet Security Systems Security Brief September 22, 2002 Propagation of "Slapper" OpenSSL/Apache Worm Variant Synopsis: ISS X-Force has learned of the existence of a variant of the "Slapper" (also known as Slapper.A) worm that X-Force documented in a X-Force Security Alert on September 14, 2002. The new variant, named Slapper.B, has several subtle differences from the first Slapper worm, but it is for the most part an updated version of its predecessor. Both versions carry the same attack payload and attempt to exploit a previously disclosed vulnerability in the Secure Sockets Layer 2.0 (SSLv2) handshake process. Slapper.A and Slapper.B both target the Linux operating system running the Apache Web server with OpenSSL. ---end quoting--- Thank you. --------------------------------- MIo Yahoo! : personalizza Yahoo! come piace a te

1 0

SElinux newbie seeks starter paper(s)
by Michael Zimmermann 22 Sep '02

22 Sep '02

Hi list, as a SElinux newbie I'm feeling a little bit lost with those rather technical papers in the SElinux documentation. Are there some starter docs available? My goal is to use SElinux on SuSE 8.0, but any more basic/practical info would also be appreciated. Thanks for any pointers and/or comments. Michael -- Michael Zimmermann (http://vegaa.de)

1 0

prefered way of persistent mode with pppoed to T-DSL on 7.3
by Hans-Peter Jansen 21 Sep '02

21 Sep '02

Hi, FM is talking of resource wastings and security issues, but doesn't tell, how to enable pppd 'persist' and 'holdoff 60' options for pppoed, which reads obviously /etc/pppoed.conf, but does it read /etc/ppp/peers/pppoe, too? TIA, Hans-Peter

1 0

Iptables, what to upgrade
by Bo Jacobsen 21 Sep '02

21 Sep '02

Hi, I have a number of 7.3 and 8.0 SuSE machines (running 2.4.16, 2.4.19-6 and 2.4.19-19 kernels) and would like to upgrade iptables on all of them, to the newest version. I understand that iptables consists of the part in the kernel, and the user space tools. I trust that one has to make sure that the version of the user space tools and the part of iptables located in the kernel, somehow ?. How do I display the version of iptables located in the kernel. I would like to upgrade iptables on all machines to the newest versions. Is that possible on all the machines with the above kernel versions ?. Thanks in advance Bo Jacobsen

1 0

Mandatory access controls in SuSE?
by Thomas Jones 21 Sep '02

21 Sep '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Does anyone know if suse(or any other commercial distro) has been looking at utilizing a MAC schema to confine process control? I for one...would like to see an implementation of security controls deployed to normal user desktops. I realize that SE-Linux is out there...but i'm talking about everyday internet users....i.e...the use of X would be required. - -- Thomas Jones i-Null.com Network Administrator -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9jIZK9w7alPkpvvsRAr1kAJwKE8XT95yQGfEVx7SHDjnmJyuccwCfW8Rv V2p1IHxPCw4fkqXcoP2+TrI= =4jJU -----END PGP SIGNATURE-----

1 0