October 2003 - openSUSE Security - openSUSE Mailing Lists

EXPLOIT?!?!
by Radu Voicu 06 Oct '03

06 Oct '03

"Affected: SuSE Linux 8.2Pro Not affected: SuSE Linux 7.3Pro, non-SuSE distributions Possibly affected: other SuSE distributions Vulnerable package: susewm Impact: Local user can gain root privileges Exploit type: Symlink attack Release date: October 6th 2003 Vendor status: SuSE was contacted on September 4th (> 1 month ago). No SuSE-patch yet. A symlink vulnerability exists in the shell script /sbin/conf.d/SuSEconfig.susewm, line 86. This shell script is part of the "susewm" package. This package is required by the package "kdebase3", so if KDE3 is installed on your system(s), you should be vulnerable." ...please read the link I provided for further details http://amor.rz.hu-berlin.de/~nordhaus/sec/vul/1_index.html

2 1

AW: [suse-security] Re: SSH and Apache warnings Nessus
by Hollweg, Daniel 06 Oct '03

06 Oct '03

> -----Ursprungliche Nachricht----- > Von: Stefan Andreas Tichy [mailto:listuser@pi4tel.de] > Gesendet: Montag, 6. Oktober 2003 14:42 > An: suse-security(a)suse.com > Betreff: [suse-security] Re: SSH and Apache warnings Nessus > > > On Mon, Oct 06, 2003 at 08:09:37AM +0100, Hollweg, Daniel wrote: > > I have two problems with a new installed SuSe Linux > Professional 8.2. > > All current patches are applied. Wehn I am scanning the box > with the > > nessus I get the following warnings: > > > > - You are running a version of OpenSSH which is older than 3.7.1 > > > > - You are running OpenSSH-portable 3.6.1p1 or older. > > If possible SuSE applies fixes to software versions > originally delivered > with some SuSE distribution. Therefore upgrading to the newest > versions is not neccessary. > > > > Is this O.K. and just an Nessus Problem with the SuSe version of > > SSH? > > Yes > > > > - The remote HTTP server allows an attacker to read > arbitrary files > > on the remote web server, simply by adding a slash in > front of its name. > > Example: GET //etc/passwd will return /etc/passwd. > > There has been a vulnerability in mod_rewrite, but it should be no > problem using apache installed with SuSE 8.2. > http://www.apacheweek.com/issues/00-09-22 > > > I already installed the newest SuSe Apache 1.3 package. > Where is the problem? > > Amazing is that the GET request does not return the whole > passwd but only two > > lines. > > Is this just some nessus information or did you reproduce the > problem? I tested it and it returns two lines of my /etc/passwd. Other files like /etc/inittab result in a Error 403. Here is a sample output: root:*:0:0::/:/etc/ftponly foo:x:502:503::/home/foo/public_html/./:/bin/false Regards, Daniel

2 1

passwd on website
by Dominik Składanowski 06 Oct '03

06 Oct '03

Hello list. I need to have change system password through website. I tried chpasswd (https://chpasswd.sourceforge.net/) but on SuSE 8.2 Pro I can't pass compilation. Besides it is rather old soft... Anybody knows other possibility to do that? -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Skladanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl ++++++++++++++++++++++++++++++++++++++++++

7 7

SSH and Apache warnings Nessus
by Hollweg, Daniel 06 Oct '03

06 Oct '03

Hi List! I have two problems with a new installed SuSe Linux Professional 8.2. All current patches are applied. Wehn I am scanning the box with the nessus I get the following warnings: - You are running a version of OpenSSH which is older than 3.7.1 - You are running OpenSSH-portable 3.6.1p1 or older. As I wrote before I installed the latest SSH Version from SuSe. Is this O.K. and just an Nessus Problem with the SuSe version of SSH? - The remote HTTP server allows an attacker to read arbitrary files on the remote web server, simply by adding a slash in front of its name. Example: GET //etc/passwd will return /etc/passwd. I already installed the newest SuSe Apache 1.3 package. Where is the problem? Amazing is that the GET request does not return the whole passwd but only two lines. Any suggestions? Thanks, Daniel

3 2

Problem: permission bits changed on files automatically
by David C. Grosvold 06 Oct '03

06 Oct '03

Anybody have any experience with this? On an intermittent basis, all of the files in my home directory with mode 0775 are changed to mode 0675 without my knowledge. I've checked the cron jobs for root to see if anything looks out of place, but nothing shows up. I'm running SuSE 8.2, with everything up to date, but this has been happening since version 7.3, it's just now become so frequent that I've decided I have to resolve it. I usually discover the problem when shell scripts or Perl scripts suddenly stop working when I call them from either the command line or cron. My SuSE system is on DSL, with a D-Link 604 DSL router, an internal network with Windoze 2000 (two laptops and a desktop) and an old SCO Unix 5.0 box. I have Samba 2.2.7a running to allow the Windoze boxes to use the SuSE box as a file exchange point, McAfee virusscan is installed on all Windoze boxes. I do cross-platform database development using Linux, Windoze, and Unix, but my primary box and my desktop are Linux. Windoze is there solely for development purposes. I've been a Unix/Linux system administrator for 15 years - my firs Unix box was a Unisys Tower (re-badged NCR Tower) with a Motorola 68020 processor and NCR Tower Unix (AT&T SystemV release 2.5). Things have come a mightly klong way since then. At any rate, if anyone can shed any light on this, it would be appreciated. -- --------------------------------------------------- Dave Grosvold dave(a)rcanyon.com ---------------------------------------------------

3 3

AW: [suse-security] Mail missplaced or lost
by Ulrich Roth 06 Oct '03

06 Oct '03

Hi David, > I have a system running SuSE 7.3 with all updates, and I noticed that > > the old mail (readed) was moving to the Trash folder or there was > another new folder instead with the old mail. I don't know when the > problem started but it is happening on multiple accounts, if > not in all. Did you ask your users if they did anything they didn't do before? Do they use a new mail program? Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

1 0

Help seeting SuSEfirewall2
by Rafael E. Herrera 05 Oct '03

05 Oct '03

Hello, I would like to be able to have a machine with that allows remote connections through SSH. It should also accept traffic through 15 UDP ports. The SSH and 15 UPD ports traffic should be limited to two subnets: in the example below, they are 12.203.150.0/24 and 12.203.162.0/26. All other traffic should be rejected. The machine will not act as a router, I just want to use SuSEfirewall2 as a personal firewall. I only has one network card. Will the configuration file below satisfy the requirements I've stated? I suspect I'm allowing anybody to connect suing ssh by setting FW_SERVICES_EXT_TCP, is that correct? I'd appreciate any suggestion. Rafael -------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="40001:40015" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="12.203.150.0/24 12.203.162.0/26" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

2 2

SuSE honeyd rpm's
by Thomas Jones 05 Oct '03

05 Oct '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all, I've taken the liberty of building the RPM's for honeyd 0.6a. I did a quick search on google and didn't find any available. So let me know if there is already one(or all) available. The pre-compiled 0.5 is nice; but i prefer to have everything in it's rightful place. It's getting late ---- so i may have fragged a path or something ----- would someone with a clean system be willing to do a install to check it out for me? These are not CVS pulls, so they should be stable. http://www.linux-howtos.com/releases/honeyd-0.6a-1.i386.rpm http://www.linux-howtos.com/releases/libdnet-1.7-1.i386.rpm http://www.linux-howtos.com/releases/libevent-0.7a-1.i386.rpm Let me know how they work. Thanks for your time. - -- Thomas Jones Linux-Howtos Network Administrator OpenGPG Key: 0x6A3DF6E9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iD8DBQE/f+W+QT2komo99ukRAq9YAJwLqIDC1TVC/M21jAbVAHOw5TnaCgCeKrpg yY48xiX3TTTf6Ra/JeLImS0= =L//K -----END PGP SIGNATURE-----

1 0

Secure Mail Server
by João Reis 04 Oct '03

04 Oct '03

Hi to all. I would like to implement a secure Mail server. This is an internal mail server and belongs to the network behind the external firewall. I also would like to have a system which permits external users to connect to the internal mail server in order to fetch their internal mail or to send their mail througth this server (POP with SSL and SMTP). The only way i see to have external connection is to add a rule to my firewall teling it to redirect all POP and SMTP traffic to this internal server. Is there a more secure way to do this? Is it secure to implement this scheme? I think this way my internal mail is exposed to the world, but i don't see other solution to do what i pretend.... Any suggestion ? Thanks in advance, P.S : sorry about my english João Reis ==========================================================

4 3

AW: [suse-security] explicitly allow fragmented packets in ipsec environment - unset the DF bit
by mailinglists 03 Oct '03

03 Oct '03

Hi > > I can send 15 Kbyte (I haven't tried larger packets yet but > I'm sure they > > will go through the tunnel as well) pings to the other end > of an ipsec > > (freeswan-freeswan) tunnel. Checking my fragmented packets > the DF bit is > > not set. The other end of the tunnel, however, can "only" > send 1500 Byte > > pings to me. Those packets have the DF bit set. > The following is taken from > /usr/src/linux/Documentation/Configure.help: > > > TCPMSS target support > CONFIG_IP_NF_TARGET_TCPMSS > This option adds a `TCPMSS' target, which allows you to alter the > MSS value of TCP SYN packets, to control the maximum size for that > connection (usually limiting it to your outgoing interface's MTU > minus 40). > > This is used to overcome criminally braindead ISPs or servers which > block ICMP Fragmentation Needed packets. The symptoms of this > problem are that everything works fine from your Linux > firewall/router, but machines behind it can never exchange large > packets > [...] > > > This sounds quite a bit like your problem. One of your > systems seems to be > unable to send fragmented packets. And as 1500 bytes is > probably your MTU, > the host that cannot send fragmented packets cannot send > packets larger than > 1500 bytes. Maybe this is simply because you yourself are > blocking the "ICMP > Fragmentation Needed packets", so check your firewall > rules/logs. Don't need to. ICMP 3 allowed everywhere. > If that > doesn't help, maybe this kernel option will. I'll try. Thanks Philipp

1 0