May 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] 2.4 routing table DOS flaw question
by GentooRulez 16 May '03

16 May '03

Oops, now that i'am reading it a second time it seems to be a local exploit but not remote exploitable. Isn't it? snip ----- This flaw can allow an unprivileged local user to gain read and write access to I/O ports on the system. ---- snap Regards Michael

1 0

2.4 routing table DOS flaw question
by GentooRulez 16 May '03

16 May '03

Here is a nadvisory http://rhn.redhat.com/errata/RHSA-2003-172.html that describes a flaw in 2.4.x kernel routing hash table. Do i need to patch my kernel and restart the box (and loose my heavy uptime) even if iptables filters all packets come in and are not related to a self established connection? In other words, if a router serves nothing and incoming packets are blocked, the routing table comes not in the game and i dont need to patch? AND - is there a way using iptools (ip route) to circumvent the problem? Regards Michael

1 0

Re: [suse-security] What has happened to harsen_suse in SuSE 8.2]
by Bill Eastman 16 May '03

16 May '03

On Thu, 2003-05-15 at 19:18, Joerg Mayer wrote: > On Thu, May 15, 2003 at 12:39:07PM -0500, Bill Eastman wrote: > > I wish SuSE had an install EVERYTHING that REALLY installed EVERYTHING > > instead of "Everything SuSE thinks I need". > > I don't think that this is possible: Some packages exclude each other > because they would provide files with identical names (postfix/sendmail). In that case, present a list and let the person doing the install make a choice (at least the professional version). At least include memtest86, updatedb, locate. When I installed memtest86 using yast, it did NOT edit grub, so I had to add it to grub manually. Leave the home version like it is. -- Bill Eastman <beastman(a)austin.rr.com>

1 0

re: [suse-security] Sambal root exploit found
by Michael Ryan 16 May '03

16 May '03

Patches for samba have been available for around a month now ... take the box offline, wipe it and re-install SuSE 8.1 or 8.2 if possible. Use SuSEfirewall2 to block access to unneeded services and/or disable them. Best advice I can give I'm afraid ... mik Christian Boxhammer <box(a)mail.geod.uni-bonn.de> wrote: __________ >Hello list, > >I have found a root exploit on our Linux Server (SuSE 7.2). The machine ist >running samba-2.2.0a-51. This root exploit is named sambal. It creates a new >user named postgres with HOME=/var/lib/pgsql/. >It can attack Linux, FreeBSD, NetBSD and OpenBSD machines. The source Code of >this exploit can be found on www.netric.org. > >My Problems: >How dangerous is this? >How can I detect, what the hacker does with our system? (HISTFILE unset by >exploit) >Does anyone know anything about sambal? > >Thanks > Christian > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

What has happened to harsen_suse in SuSE 8.2
by Bo Jacobsen 16 May '03

16 May '03

What has happened to harden_suse. I see that it's no longer present in 8.2 ?!. I have always used this program and is now wondering what to use instead. Bo Jacobsen

3 2

FW_MASQ_DEV="$FW_DEV_EXT"
by philt 16 May '03

16 May '03

If I change this to only read ppp0 is it going to remove the following iptable entry 0 0 MASQUERADE all -- any ipsec0 192.168.0.0/24 anywhere FW_MASQ_DEV="$FW_DEV_EXT" Could I have been struggling for days and not got this? -- Absolute Internet Services (http://www.aiserve.net)

1 0

SuSEfirewall2 and NAT help : i am so lost!
by David T-G 15 May '03

15 May '03

Hi, all -- From reviewing the archives I *believe* I'm in a good place to ask, but I could be wrong. Please be gentle in your redirection :-) I am a loyal :-) SuSE user and am doing some work for a client who has finally switched from SCO UNIX to SCO's version of Linux, which includes SuSEfirewall2 and otherwise looks quite a bit like a SuSE system (gee, go figure!). In any given location he has a static external interface and a 10.x.y.z internal interface and would like to do NATting for his internal windows machines. I am trying to write a script to configure and enable SuSEfirewall2 for this so that he can do a hands-off install on his literally thousands of clients. SCO UNIX used ipf and ipnat, and I got those simple rules worked out. Now I need to do the same thing for iptables and SuSEfirewall2 and I'm pretty lost. Recalling that this has to be a hands-off install, I have whipped up a little script to identify the internal and external interfaces, and then apply cat /etc/sysconfig/SuSEfirewall2.bak.$$ | \ sed \ -e "s/FW_DEV_EXT=.*/FW_DEV_EXT='$EXT'/" \ -e "s/FW_DEV_INT=.*/FW_DEV_INT='$INT'/" \ -e "s/FW_QUICKMODE=.*/FW_QUICKMODE='yes'/" \ -e "s/FW_ROUTE=.*/FW_ROUTE='yes'/" \ -e "s/FW_MASQUERADE=.*/FW_MASQUERADE='yes'/" \ -e "s:FW_MASQ_NETS=.*:FW_MASQ_NETS='10.0.0.0/8':" \ -e "s/FW_SERVICES_QUICK_TCP=.*/FW_SERVICES_QUICK_TCP='telnet ftp ssh www mysql'/" \ -e "s:FW_TRUSTED_NETS=.*:FW_TRUSTED_NETS='10.0.0.0/8':" > \ /etc/sysconfig/SuSEfirewall2 to set the variables accordingly and then create the rc?.d start and stop symlinks for the three scripts. Unfortunately, a client machine on the inside properly pointing to the internal address as its default gateway cannot get through. Having read the example file, asked google for help, read through list archives, and generally poked and prodded everywhere I can, I've come up with many "you need to turn on NAT" but no pointers to how to do so! TIA & HAND :-D -- David T-G * There is too much animal courage in (play) davidtg(a)justpickone.org * society and not sufficient moral courage. (work) davidtgwork(a)justpickone.org -- Mary Baker Eddy, "Science and Health" http://justpickone.org/davidtg/ Shpx gur Pbzzhavpngvbaf Qrprapl Npg!

2 1

What has happened to harden_suse in SuSE 8.2
by Bo Jacobsen 15 May '03

15 May '03

What has happened to harden_suse. I see that it's no longer present in 8.2 ?!. I have always used this program and is now wondering what to use instead. Bo Jacobsen

2 2

colgar pagina en apache
by Lucio Solorzano 15 May '03

15 May '03

Creo que mi problema es que estoy usando un script de Visual Basic para validar los usuarios que pueden entrar a ver el contenido de la pagina, lo que pasa es que primero lo hice usando el frontpage y le agrege scripts como el de la validacion de usuarios. Linux corre scripts de VB ? o solamente de Java Saludos, > > Method Not Allowed > > > > The requested method POST is not allowed for the URL /pagina1.htm. > > > > ---------- > > Apache/1.3.23 Server at server.cidelsa.com.pe Port 80 > > > > Esperando su respuesta > > > > Gracias > >

1 0

[suse-security] Strange behaviour of SuSE
by Bill.Light＠kp.org 15 May '03

15 May '03

If no one else has answered - You've been rooted... See how to do it at Cyberborneo: http://www.cyberborneo.com/tutorial.htm Take the machine off line - you don't own it anymore.... ================================================================================= Hi there! I have a little problem with our Linux server and I don't know, if it's perhaps a security problem. We run a samba server with SuSE 7.3 Last days, it behaves a little bit strange: At the first time, I wasn't able to login at the console with the root account. After entering the username root, nothing happens. From remote with ssh, I could login. Now, after some days, no root login is possible - even ssh says "access denied" When I login as normal user, I see two files in the root directory of the volume named "devory" and "slamet". I didn't create the files. They have the same date attribute and nearly the same time attribute. The server itself seems to work without problems. Is this a security problem, a hard disk problem or what else? Regards, Wolfgang Eul -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0