December 2003 - openSUSE Security - openSUSE Mailing Lists

Some services fail when rebooting after kernel update
by Sven Wahl 08 Dec '03

08 Dec '03

Dear folks I'm running SuSE Linux 8.0 and updated the kernel package from k_deflt-2.4.18-58 to k_deflt-2.4.18-281 as described in yesterdays SuSE security announcement. However, two services fail to start repeatedly when rebooting my machine. 1) SSH daemon SSH daemon exits with status 7. I tried to discover what this error code is supposed to tell, but I couldn't find it in the sshd manpage. So, I haven't got any clue and would really appreciate a hint from the list. Here are the full logs grabbed from /var/log/boot.msg: <notice>/etc/init.d/rc5.d/S10sshd start Starting SSH daemon failed <notice>startproc: execve (/usr/sbin/sshd) [ /usr/sbin/sshd ], [ PWD=/ HOSTNAME=lux CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES REDIRECT=/dev/tty1 MACHTYPE=i386-suse-linux LINES=34 SHLVL=2 COLUMNS=105 BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin RUNLEVEL=5 INIT_VERSION=sysvinit-2.82 _=/sbin/startproc DAEMON=/usr/sbin/sshd ] <notice>'/etc/init.d/rc5.d/S10sshd start' exits with status 7 2) Alsa sound daemon It seems that some modules have been renamed, so that they can't be found anymore. The logs read: <notice>/etc/init.d/rc5.d/S12alsasound start Starting sound driver: intel8x0modprobe: Can't locate module snd-intel8x0 failed <notice>'/etc/init.d/rc5.d/S12alsasound start' exits with status 0 I checked the directory /lib/modules/2.4.18-4GB/misc and assume that the appropriate module should be called snd-card-intel8x0 instead of snd-intel8x0, which no longer exists. Could I just create a link to solve this? Thank you for your help in advance! /Sven

3 4

SHH - login problems after Upgrade 8.2 - 9.0
by Philipp Rusch 08 Dec '03

08 Dec '03

Hello list, I did an upgrade with my box from 8.2 to version 9.0. After this change I was not able to login with ssh-clients from remote anymore. I am only able to login through local consoles or insecure telnet ! Where do I have to look now, what changed in version 9 ? I had this working before on my systems and did not change a thing in my ssh-setup myself ... What I tried / looked at so far: I have reverse DNS lookup working, the hostnames are resolved. OK I have no lines in host.allow concerning sshd, is this still OK ? same applies to host.deny OK I use xinetd to start vnc since this version 9 of SuSE, does this change something to other services ? I get the certificate at my clienst, I accept it and then get the "login:" prompt, but none of my users / passwords is accepted. Has there been a change in passwords (encryption ?) Any help is appreciated, I really like to have this working again. Thanks in advance, Philipp

4 4

Re: SuSE Security Announcement: Kernel brk() vulnerability (SuSE-SA:2003:049)
by Lise Moorveld 08 Dec '03

08 Dec '03

Hi, Could anyone tell me whether this issue: >- don't allow users to send signals to kmod is SuSE specific? I have not found any mention of this on kernel.org, bugtraq, or anywhere else. Does anybody have any more info on this? Would be greatly appreciated :) Kind regards, Lise _________________________________________________________________ Talk with your online friends with MSN Messenger http://messenger.msn.nl/

1 0

Remove from List
by Eric Landry 08 Dec '03

08 Dec '03

1 0

Take me off list
by bowm9808＠bellsouth.net 08 Dec '03

08 Dec '03

Please take me off your mailing list. Thank you.

1 0

Error making new kernel ...
by Ray Leach 08 Dec '03

08 Dec '03

Hi Is this an error compiling the kernel, or am I just doing something really dumb? I get this error when I do a make modules_install: cd /lib/modules/2.4.20-4GB; \ mkdir -p pcmcia; \ find kernel -path '*/pcmcia/*' -name '*.o' | xargs -i -r ln -sf ../{} pcmcia if [ -r System.map ]; then /sbin/depmod -ae -F System.map 2.4.20-4GB; fi depmod: *** Unresolved symbols in /lib/modules/2.4.20-4GB/dvb/dvb-ttpci.o depmod: input_register_device depmod: video_register_device depmod: video_unregister_device depmod: input_unregister_device depmod: input_event make modules seems to work fine, so how can there be unresolved symbols? Regards Ray -- -- Raymond Leach <raymondl(a)knowledgefactory.co.za> Network Support Specialist http://www.knowledgefactory.co.za "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 --

1 0

FreeS/WAN and NAT traversal patch
by Michael Ryan 08 Dec '03

08 Dec '03

Has anyone used the NAT traversal patch (http://open-source.arkoon.net/freeswan.php#natt) with FreeS/WAN on SuSE? How well does it interoperate with NAT-T aware VPN client software e.g. SafeNet SoftRemote? How easy is it to incorporate this patch into the FreeS/WAN packages which ship with SuSE or would I be better off downloading Super FreeS/WAN (http://www.freeswan.ca/)? TIA Michael

1 0

Kernel Update problem IPv6
by Mario Neubert 08 Dec '03

08 Dec '03

hello list, I want to build my own kernel from SuSE source rpm's on SuSE 8.1. I do a make oldconfig and answer all questions about new features with the default... N(o). Then I make menuconfig and I select my network card VIA-RHINE as compiled in (no module). Exit->Save. Then I make dep clean bzImage all is fine only the make modules shows the following error message: gcc -D__KERNEL__ -I/usr/src/linux-2.4.21-151/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -msoft-float -mpreferred-stack-boundary=2 -march=pentium3 -DMODULE -nostdinc -iwithprefix include -DKBUILD_BASENAME=addrconf -c -o addrconf.o addrconf.c addrconf.c: In function `in6_dev_finish_destroy': addrconf.c:396: structure has no member named `regen_timer' addrconf.c: In function `addrconf_prefix_rcv': addrconf.c:1983: warning: unsigned int format, long unsigned int arg (arg 3) make[2]: *** [addrconf.o] Error 1 make[2]: Leaving directory `/usr/src/linux-2.4.21-151/net/ipv6' make[1]: *** [_modsubdir_ipv6] Error 2 make[1]: Leaving directory `/usr/src/linux-2.4.21-151/net' make: *** [_mod_net] Error 2 Has anybody the same error or can me help with this problem? Thx /Mario Neubert

2 1

Stack Overflow Protection
by Bernhard Walle 08 Dec '03

08 Dec '03

Hello, on http://lists.suse.com/archive/suse-security/2003-Dec/0051.html I read that the SuSE 9.0 update kernel contains Stack Overflow Protection. I tested this with a short example from an article in the German computer magazine c't ("Das Sicherheitsloch", c't 23/2001, p. 216) 1 void function(int a, int b, int c) { 2 char buffer1[8]; 3 char buffer2[16]; 4 int *ret; 5 6 ret = buffer1 + 12; 7 (*ret) += 8; 8 } 9 10 void main() { 11 int x; 12 13 x = 0; 14 function(1,2,3); 15 x = 1; 16 printf("%d\n",x); 17 } On SuSE 9.0 this produces "1", which is correct, on an old machine it produces "0", which is incorrect. My questions are now: 1. Does this protection have any disadvantages? 2. Will it be included in future versions of the vanilla kernel? 3. Why is this a "hidden feature"? Why doesn't SuSE let the people know that they've included this stack overflow protection? Regards, Bernhard

5 5

Stopping XSS attacks
by Keith Roberts 07 Dec '03

07 Dec '03

Hi all! I have found a way to limit the effects of Cross Site Scripting attacks - possibly stopping them completely. The idea is to write a 'closed site' that will not allow passing of variables on the URL line. This has been tested with apache 1.3.26, php4 etc under SuSE 8.1 pro on my box. (site is still under development - though I may put it on line for testing purposes if you want to contact me first) I've used special FORM POST buttons written for passing values between php4 scripts in a closed environment. (please see below) The only way into the website is via a URL WITHOUT anything passed after the ? of the URL. Once a user is on the homepage, they have to use the special FORM POST buttons to navigate this site. This is what I use on my website, which is STILL under construction, due to security issues, such as XSS. Any attempt to pass variables with the URL will be identified and the script will terminate! Would this be of use in stopping/limiting cross site scripting exploits, ref: CA-2000-02 ? Here it is: // this line needs to be called at the begining of each php4 // script, to put the URL query string into the global scope. // register_globals in php.ini must be set to OFF // or this method will not work! $url_string = $_SERVER["QUERY_STRING"]; /*-------------------------------------------------------------*/ /* Call this function (from an included file) at the start of each php4 script to detect and stop variables from being passed in the URL query string. */ function url_check($url_string) { if (DEBUG_CODE) { echo "common.url string: '$url_string' <BR>"; } if ('' <> $url_string) { echo '<P> Passing of variables by URL query string is not supported! <BR>'. 'Program terminating now - Please try again'; echo '<P> Found in URL -> ' . $url_string . '<BR>'; exit(); } } /*-------------------------------------------------------------*/ So, if an attacker tries to pass anything on the URL line, it will not be accepted! Then, instead of using an HREF link, I use a custom php4 function like the one below, for each script to be called. All these 'buttons' live in an include file, that is included at the start of each executable script. Other advantages are that the button is declared only once, but available to ALL pages that include it! This makes updating variables passed to other pages very easy to, as they ONLY need to be modified once, in the included file! As register_globals is OFF, the hidden variables passed from the calling script, have to be made available to the called script with: /*--------------------------------------------------*/ // get form button POST variables from array $host_name = $HTTP_POST_VARS["host_name"]; $debug_value = $HTTP_POST_VARS["debug_value"]; $table_output = $HTTP_POST_VARS["table_output"]; $advcd_search = $HTTP_POST_VARS["advcd_search"]; // $xyz_var_name = $HTTP_POST_VARS["xyz_var_name"]; /*--------------------------------------------------*/ At the start of each script, before they are accessed. This puts them back into the global scope, as if register_globals was set to ON. As you can see from below, this is just a simple HTML form, with no INPUT controls, so all the user sees is the submit button, with a descriptive name telling them what pressing the button will do. /*---------------------------------------------------------*/ /* (simple) Search for a mutual property exchange button */ /*---------------------------------------------------------*/ function simple_SEARCH_button($text) { // declare the following variables as global to access them global $debug_value; global $table_output; ?>  <FORM ACTION="./search.hml" METHOD="POST"> <P ALIGN=CENTER> <INPUT TYPE="SUBMIT" VALUE="<?php echo $text; ?>"> </P>   <INPUT TYPE="HIDDEN" NAME="debug_value" VALUE="<?php echo $debug_value; ?>"> <INPUT TYPE="HIDDEN" NAME="table_output" VALUE="<?php echo $table_output; ?>"> <INPUT TYPE="HIDDEN" NAME="advcd_search" VALUE="OFF">  </FORM> <?php // back into php mode } // end of function simple_SEARCH_button($text) /*-------------------------------------------------------------*/ /*--------------------------------------------------*/ /* Advanced search for a property exchange button */ /*--------------------------------------------------*/ function ADVCD_SEARCH_button($text) { // declare the following variables as global to access them global $debug_value; global $table_output; ?>  <FORM ACTION="./search.hml" METHOD="POST"> <P ALIGN=CENTER> <INPUT TYPE="SUBMIT" VALUE="<?php echo $text; ?>"> </P>   <INPUT TYPE="HIDDEN" NAME="debug_value" VALUE="<?php echo $debug_value; ?>"> <INPUT TYPE="HIDDEN" NAME="table_output" VALUE="<?php echo $table_output; ?>"> <INPUT TYPE="HIDDEN" NAME="advcd_search" VALUE="ON">  </FORM> <?php // back into php mode } // end of function ADVCD_SEARCH_button($text) /*-------------------------------------------------------------*/ Then, to call for example, the script search.hml from another page I use: <TR> <TD COLSPAN="100%"> <?php // back into php mode simple_SEARCH_button('Search for a mutual property exchange'); ?>  <TR> <TD COLSPAN="100%"> <?php // back into php mode ADVCD_SEARCH_button('Advanced search for a property exchange'); ?>  <TR> <TD COLSPAN="100%"> <?php // back into php mode ADD_REC_button('Add your exchange details to the database'); ?>  <TR> <TD COLSPAN="100%"> <?php // back into php mode EDIT_REC_button('Update your details in the database'); ?>  So, variables are passed between the php4 scripts, as HIDDEN HTML FORM variables, and not on the URL line. AFAIK, this makes altering values passed between scripts very difficult for attackers, which is what is intended. If you have any comments or questions please contact me, Kind Regards - Keith Roberts

2 1