June 2003 - openSUSE Security - openSUSE Mailing Lists

Sendmail 8.12.3-75 exploit
by Paulo Melo 26 Jun '03

26 Jun '03

hi all, for the last weeks I was detecting a problem in my sendmail MTA. This is some lines from my sendmail.log Jun 26 16:28:27 smtp sendmail[1545]: h5QFSPiQ001545: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=omr-r09.mx.aol.com [152.163.225.154] Jun 26 16:28:51 smtp sendmail[1550]: h5QFSgiQ001550: from=<>, size=4529, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=gandalf.warpdrive.net [24.56.130.20] Jun 26 16:32:38 smtp sendmail[1607]: h5QFWXiQ001607: from=<>, size=0, class=0, nrcpts=0, proto=SMTP, daemon=MSA, relay=mx1.thebiz.net [216.238.0.21] Jun 26 16:34:34 smtp sendmail[1630]: h5QFYWiQ001630: from=<>, size=0, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=omr-r09.mx.aol.com [152.163.225.154] Jun 26 16:34:55 smtp sendmail[1633]: h5QFYriQ001633: from=<>, size=5120, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=smtp03.infoave.net [165.166.0.28] Jun 26 16:36:20 smtp sendmail[1644]: h5QFaHiQ001644: from=<>, size=4693, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=e35.co.us.ibm.com [32.97.110.133] Jun 26 16:38:15 smtp sendmail[1653]: h5QFcDiQ001653: from=<>, size=3302, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=blackbox.inta.net [194.70.70.70] Jun 26 16:42:27 smtp sendmail[1713]: h5QFgPiQ001713: from=<>, size=3453, class=0, nrcpts=0, proto=ESMTP, daemon=MSA, relay=fep21.swip.net [130.244.199.149] I'm using SuSE 8.0 version with sendmail 8.12.3-75, and I implemented some modifications in linux.mc in order to activate dnsbl, and so far is ok. I made some open relay test and I'm sure that every thing is well done.... Does any one know how to solve this problem? Paulo Jorge de Melo Gabinete de Informática e Estatística Comissão de Coordenação da Região Centro _________________________________________________________________________________________________ "What? You search? You would multiply yourself by ten, by a hundred? You seek followers? Seek zeros! "- Nietzsche

1 0

yppasswd(d)
by Guido Tschakert 26 Jun '03

26 Jun '03

Hello, I try to build a NIS-Server with SuSE 8.2 Everything works fine except changing my password from a client with (yp)passwd. I always get the answer: yppasswdd not running on NIS master lsof -i on the server shows me the entry: rpc.yppas 5292 root 4u IPv4 112120 UDP *:805 rpcinfo -p server gives the line 100009 1 udp 805 yppasswdd But if I try (yp)passwd on the client and sniff the net with tcpdump there is no communication between my client and the NIS-server on port 805. I searched all the conf-files for NIS but didn't find anything. I also asked myself, how yppasswd (or ypbind) knows which port to use, because the prot of rpc.yppasswdd changes everytime the daemon (or ypserv) is restartet. Every hints are welcome (yes, I did a RTFM) guido

1 0

Peter Kanters/NL/ABNAMRO/NL is out of the office.
by peter.kanters＠nl.abnamro.com 26 Jun '03

26 Jun '03

I will be out of the office starting 26-06-2003 and will not return until 11-08-2003. I will respond to your message when I return. --------------------------------------------------------------------------- This message (including any attachments) is confidential and may be privileged. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorised use or dissemination of this message in whole or in part is strictly prohibited. Please note that e-mails are susceptible to change. ABN AMRO Bank N.V. (including its group companies) shall not be liable for the improper or incomplete transmission of the information contained in this communication nor for any delay in its receipt or damage to your system. ABN AMRO Bank N.V. (or its group companies) does not guarantee that the integrity of this communication has been maintained nor that this communication is free of viruses, interceptions or interference. ---------------------------------------------------------------------------

1 0

ip masquerading problem
by Lehel 26 Jun '03

26 Jun '03

i have a SuSE 8.0 pro set up on a machine to do masquerading. I share a cable modem internet connection with a windows 2000 machine. The ip masq has worked up until I moved and got my computers set up again. SuSEFirewall2 seems to freeze up the computer during boot if it has gotten a valid ip address for eth0 from the dhcp server. I have the same ISP. The only thing that has changed is the external ip address and the type of cable modem i am using. I am not sure if an update changed something.... If I disable masquerading in the Firewall wizard, the firewall restarts fine but when I enable it again, it hangs. I am using 10.0.0.x for my internal ips on eth1 and on my win2k. Any ideas?

2 1

sshd needs long time to authenticate
by brockmeyer＠akustikbuero.de 25 Jun '03

25 Jun '03

Hi out there, we are using Suse Linux 8.1 for our server and need OpenSSH to log in from other locations. We decided to use protocol version 2 with private/public key login and passphrases. It works all fine, but it needs about 2 min to authenticate. When we work with passwords it needs just a second and it makes no difference if I'm in the office or in outer space. Is there anybody who has an idea to short this long time ? Thanks Dieter Brockmeyer

3 2

VPN in DMZ
by Philipp Flesch 25 Jun '03

25 Jun '03

Hi! We are using SuSE 8.1 prof. as firewall. Now we have to add a VPN ... this VPN-"blackbox" should be in a DMZ so that I can control the traffic and what's going on on that VPN-Gateway. The VPN-Gateway only needs ftp to my firewall InternetGateway (CISCO-Router) 212.125.104.73 (mask 255.255.255.248) | | eth1 212.125.104.75 (mask 255.255.255.248) +++++Firewall (SuSE 8.1)+++++ eth2 ----- VPN eth0 10.10.0.102 (mask 255.255.0.0) | | LAN the VPN needs one of our offical IP-Adresses ... .77 and .78 are still free and the VPN needs ftp to the firewall ... how configure the DMZ on eth2? I haven't found any usefull documents in the net :-(

3 2

/usr/sbin/chat & /usr/sbin/packer
by Adam Schmidt 25 Jun '03

25 Jun '03

Both /usr/sbin/chat and /usr/sbin/packer are vulnerable to a buffer overflow on SuSE 8.0 Professional, and other versions possibly. These are local compromises. I am currently working on the code for educational purposes.

2 1

Gkrellmd buffer overflow
by Adam Schmidt 24 Jun '03

24 Jun '03

Gkrellmd 2.1.* suffers from a buffer overflow where it does not validate the 128 byte buffer input, which allows an attack to crash the daemon resulting in a denial of service. Code for the denial of service has been provided, and an exploit to take advantage of this buffer overflow remotely is currently being written. Please disable Gkrellmd until a patch is released. - Adam Schmidt http://stream.gotdns.org/projects/gkrellmd.pl

1 0

Re: [suse-security] SuSeFirewall2 problems after reconnect (Suse 8.2)
by Volker Moesker 24 Jun '03

24 Jun '03

Thanks a lot Armin, you were absolutely right. It was my fault. I did not open the ports in "FW_SERVICES_EXT_???" like I did using Suse 8.1. The problem was, that SuSefirewall2 prompted something like unknown Service if those applications wasn't running at firewall startup. So I thought that there was no need to open highports anymore in the services because I allowed them already in "ALLOW_INCOMING_HIGHPORTS_xxx". Now I changed it and everything seems to run fine. Thanx a lot! Best regards, Volker At 09:42 24.06.2003 +0000, Armin Schoech wrote: >Hi Volker ! > >> Now if an application that is listening on highports (>1024) is already >> running before the reconnect takes place (e.G. mldonkey and hts), after the >> reconnection SuSefirewall2 is dropping packets to these highports which >> were accessable before the reconnection. >> E.G. mldonkey then only gets lo-ids and I can't access my machine via hts >> which is running @ port 4xxx. I'm not sure if SuSefirewall2 blocks all >> highports or only these on which the applications are listening. Lowports >> aren't affected. I still can connect to Apache and SSH after the reconnect. >> >--> What about the FW_AUTOPROTECT_SERVICES in >/etc/sysconfig/SuSEfirewall ? I would assume that setting this to >"yes" will have exactly the effect you describe. > >Have you considered to enter the ports you need in "FW_TRUSTED_NETS" >or "FW_SERVICES_EXT_???" ? > >HTH, >Armin > >-- >Am Hasenberg 26 office: Institut für Atmosphärenphysik >D-18209 Bad Doberan Schloss-Straße 6 >Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY >Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 >WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

"samba-vscan" & f-prot
by Oliver Cavelius 24 Jun '03

24 Jun '03

Hello there! I am using the latest versions of "samba", "samba-vsan" and f-prot but "on access scannig" doesn't to work :o( How do i have to modify "smb.conf"? Does someone have a manual / installation-instruction? Many thanks,

4 3