April 2003 - openSUSE Security - openSUSE Mailing Lists

Sendmail and PAM
by Robert Rottscholl 26 Apr '03

26 Apr '03

Hi List, is it possible to have sendmail running SMTP-Auth against a PAM password database? Greets, Robert

1 0

Firewall Admin Utility for 7.2
by Istvan Hollo 26 Apr '03

26 Apr '03

Hi List, Is there something user-friendly firewall administration utility for v7.2? istvan

3 2

mailx dumps core if line with NUL character in mail
by Peter Karl Müller 25 Apr '03

25 Apr '03

Using SuSE 7.3/mailx 8.1.1 Release 370 I encountered a core dump while executing the mailx command. This is caused by a line with a single NUL character. Further investiga- tion revealed a) a suspicious way to read and count the charac- ters of the mbox (setptr in fio.c): : 94 for (;;) { 95 if (fgets(linebuf, LINESIZE, ibuf) == NULL) { 96 if (append(&this, mestmp)) { 97 perror("temporary file"); 98 exit(1); 99 } 100 makemessage(mestmp); 101 return; 102 } 103 count = strlen(linebuf); 104 (void) fwrite(linebuf, sizeof *linebuf, count, otf); 105 if (ferror(otf)) { 106 perror("/tmp"); 107 exit(1); 108 } : As one easily sees fgets either retured 0 (EOF/error) or a pointer to the read characters. In the case of a NUL character, there is no chance to get the real numbers of characters behind NUL (i. e. retlf). b) using a recent version of gcc (3.2.2) does not make mailx dump the core. Nonetheless the line with the NUL character does not show if you edit the message with 'v'. May somebody please comment on this issue? TIA PKM

1 0

A vulnerability has been identified in Xinetd.
by takezou 25 Apr '03

25 Apr '03

Hi A vulnerability has been identified in Xinetd. # a denial of service (memory consumption) Is a binary patch in somewhere? Upgrade to xinetd-2.3.11 is recommended. I think that there is a problem in Suse 8.1 at least. # xinetd-2.3.6-35.src.rpm(SRPM of Suse 8.1) <reference> http://www.secunia.com/advisories/8632/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0211 ----- M. Takeyama

1 0

Please help me with secumod
by 정정모 25 Apr '03

25 Apr '03

Hello First I'm very sorry for my poor english. I have build Web site using SLES7 for s390. But the secumod package I installed can't protect procfs. In x86 machine, It protects procfs, so anybody except root could not see other's process. But in s/390 Linux, It does not operate. Please give me advice. Thanks in advance..

1 0

sendmail und SMTP-AUTscH
by Roland Hilkenbach 24 Apr '03

24 Apr '03

Hi List, I tried to get two sendmails working together but failed. What did I do wrong? Server A (LAN) is a SuSE 8.0 box with sendmail 8.12.3. It collects mail from the LAN without problems and can deliver them to other servers. If it weren't for SPAM-control of other servers... Server B is a SuSE 7.2 root-server with sendmail-tls (latest patches implemented). This box should become my relay for all mails from the LAN. If I send mail from my kmail-program, I can use authentication methods plain and login without problems. Encryption will be the next step. I setup LAN-Server A to relay mail to root-server B (SMARTHOST=...), to use Authentication method PLAIN (SMTP_AUTH_MECHANISMS="PLAIN") and I edited the auth-info file. I double checked correct spelling of servername, username and password. I let SuSEconfig do the dirty job and restarted the server - all corresponding to the article in the SDB. It simply doesn't work here! Regardless of the authentication method, every try ends up with an "authentication failed". I installed a SuSE 8.1 sendmail also but got the same result. To sum it up: kmail -> sendmail-tls works while sendmail -> sendmail-tls does not! Any hints and tipps greatly appreciated - thank You Roland Hilkenbach

2 3

Re: [suse-security] ver7.2 server was hacked - pls help
by GentooRulez 24 Apr '03

24 Apr '03

>> I'm afraid i have to reinstall the machine, but before i do it want to >> know what and how happened. > > With that kind of access you could try to see what happened, but there > are a lot of possibilities... Thats it. > now that you mentions Samba, in my LUG I > am an user was hacked, and the main suspect is samba, he don't has it > patched, and had no firewall, so the latest samba vulnerability could > have been exploited (the intruder seems to have applied the patch to fix > samba, and then installed backdoors and things like that... but left all > logged in the /root/.bash_history). That kind of things could be what > happened in your machine, but really clever guys don't left that kind of > traces. Or many other things, because according to another mail in this threat he seems to run a normal 7.2 with a lot of services bound, even finger did work. > But I think that the best is reformat/reinstall the machine, you can't > be sure what have been changed in your disk. This and nothing else. But this time harden the box. Disable all services you dont need. Use scripts like harden_suse and SuSEfirewall2 to harden and protect your system. Think on kernel patches like openwall to prevent buffer overflows and privilege escalation. Simply ask google how 2 harden a linux box. Check e.g. what the guys from http://www.trusteddebian.org/ do for the security of their distri. Cheers Michael

1 0

Vulnerability in PoPToP?
by Sven Euteneuer 23 Apr '03

23 Apr '03

Hi everybody, after seeing exploits of a security vulnerability in PoPToP pop up on Bugtraq, I'm wondering whether the version that shipped with SuSE Linux 8.0 is actually vulnerable and if yes whether there is anything in the pipeline to fix this? I wasn't able to find anything in either the security announcements or the list archives? Sven See below for the exact version: venkman:~ #rpm -qi pptpd-1.1.2-226 Name : pptpd Relocations: (not relocateable) Version : 1.1.2 Vendor: SuSE AG, Nuernberg, Germany Release : 226 Build Date: Sat Mar 23 20:18:00 2002

1 0

qpopper and OpenSSL
by Vukasin Ciric 23 Apr '03

23 Apr '03

I compiled and configured qpopper from the guide.pdf from qpopper homepage, and from the same guide I created CA. When I try to check mail, I get this: Apr 23 19:36:29 kolubara popper[10830]: OpenSSL error during handshake Apr 23 19:36:29 kolubara popper[10830]: ...SSL error: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Apr 23 19:36:29 kolubara popper[10830]: TLS/SSL Handshake failed: -1 What to do?

1 0

Re: [suse-security] ver7.2 server was hacked - pls help
by Michael Ryan 23 Apr '03

23 Apr '03

Hi Istvan, Sorry to hear about your problems ... off the bat, I'd look at Samba as a possible route the hacker(s) used to compromise your server (have you been using YOU to maintain your patch levels?) All I can suggest at this point is taking the server off-line, replacing the hard drive(s) [if you want to try and do an analysis of the hack later] and building a new server using SuSE 8.1 if possible - be VERY careful about transferring ANYTHING from the compromised server to the new server as these guys no doubt have installed a rootkit and trojanised other files on the system. Try to re-install web sites, etc from known good backups or other trusted sources. There is an open source tool out there call the Coronors toolkit which you can use to investigate the hacked platform but whether you want to take the time and trouble is up to you. Hope this is of some help. Regards, Michael

1 0