November 2004 - openSUSE Security - openSUSE Mailing Lists

Cyrus remote vulnerability
by Stefano Zanarini 28 Nov '04

28 Nov '04

what about vulnerabilities reported here : http://security.e-matters.de/advisories/152004.html is someone working on an update ? even if most of the advisories concern authenticated users (someone with a valid account) they can permit remote code execution (with cyrus user privileges I think,so an attacker could remove all mailboxes on the server for instance). will patches be available soon ? any news ? the vendor has yet corrected the bug. regards -- YACME S.r.l. Via del Mobiliere, 9 40138 Bologna Phone: +39 051 538709 Fax: +39 051 532399

2 2

Re: AW: AW: AW: AW: [suse-security] SuSEfirewall2 blocks SMB traffic
by tmp＠nitwit.de 27 Nov '04

27 Nov '04

On Saturday 27 November 2004 21:29, you wrote: > then check the logs if the firewall really drops any packets and post > your smb.conf if it doesn't Well, obviously it does drop packets. The windows machine is offline currently so my hands are tied. On the german general SuSE list i read some very similar article (the config is english anyway ;-) and in this case packets were dropped: http://lists.suse.com/archive/suse-linux/2004-Nov/2501.html

2 1

Problem with RightID
by Markus_Kaefer＠log.at 25 Nov '04

25 Nov '04

Dear Mailinglist Users, I have been working with freeswan 1.xx under debian woody for more than a year now. As roadwarrior client i used ssh sentinel ... all worked fine. now i was forced to use a 2.xx so i used the newest with an x509 patch 2.05. now i am having problems converting my ipsec.conf to the new version to work properly. I am using virtual ips to stay independent to the way the client is connected. For authentication I use openssl x509 certs, I use no subjectAltname ... I tried but it also didn't work Here is my ipsec.conf gate:/etc# cat ipsec.conf # /etc/ipsec.conf - FreeS/WAN IPsec configuration file # RCSID $Id: ipsec.conf.in,v 1.11 2003/06/13 23:28:41 sam Exp $ # This file: /usr/local/share/doc/freeswan/ipsec.conf-sample # # Manual: ipsec.conf.5 # # Help: # http://www.strongsec.com/freeswan/install.htm version 2.0 # conforms to second version of ipsec.conf specification # basic configuration config setup # Debug-logging controls: "none" for (almost) none, "all" for lots. # klipsdebug=all # plutodebug=all # crlcheckinterval=600 # strictcrlpolicy=yes interfaces=%defaultroute klipsdebug=none plutodebug=control uniqueids=yes conn %default keyingtries=1 authby=rsasig left=80.120.177.66 leftnexthop=80.120.177.65 leftcert=gate.akras.at.pem leftrsasigkey=%cert rightrsasigkey=%cert auto=add # OE policy groups are disabled by default conn block auto=ignore conn clear auto=ignore conn private auto=ignore conn private-or-clear auto=ignore conn clear-or-private auto=ignore conn packetdefault auto=ignore # Add connections here. # sample VPN connection conn virt right=%any leftsubnet=192.168.1.0/24 rightid="C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=Robert Machaczek" rightsubnetwithin=192.168.2.0/24 auto=add # Left security gateway, subnet behind it, next hop toward right. #left=80.120.177.66 #leftsubnet=192.168.1.0/24 #leftnexthop=80.120.177.65 #leftrsasigkey=%cert #leftcert=gate.akras.at.pem # Right security gateway, subnet behind it, next hop toward left. #right=%any #rightid=(a)vpn.akras.at #rightrsasigkey=%cert #rightsubnetwithin=192.168.2.0/24 #auto=add # sample VPN connection #sample# conn sample #sample# # Left security gateway, subnet behind it, next hop toward right. #sample# left=%defaultroute #sample# leftcert=gate.akras.at.pem #sample# leftsubnet=192.168.1.0/24 #sample# # Right security gateway, subnet behind it, next hop toward left. #sample# right=%any #sample# rightid="<Distinguished name of right security gateway>" #sample# rightsubnet=192.168.167.0/24 #sample# # To authorize this connection, but not actually start it, at startup, #sample# # uncomment this. #sample# #auto=start Here is the error in the log: Nov 25 10:45:36 akrasvbox pluto[5203]: | Nov 25 10:45:36 akrasvbox pluto[5203]: | *received 1564 bytes from 10.10.10.9:500 on eth0 Nov 25 10:45:36 akrasvbox pluto[5203]: | ICOOKIE: ff ee 3a 26 f8 00 00 0e Nov 25 10:45:36 akrasvbox pluto[5203]: | RCOOKIE: 6e 7e fe ff eb dc 64 47 Nov 25 10:45:36 akrasvbox pluto[5203]: | peer: 0a 0a 0a 09 Nov 25 10:45:36 akrasvbox pluto[5203]: | state hash entry 13 Nov 25 10:45:36 akrasvbox pluto[5203]: | peer and cookies match, provided msgid 00000000 vs 00000000 Nov 25 10:45:36 akrasvbox pluto[5203]: | state object #5 found, in STATE_MAIN_R2 Nov 25 10:45:36 akrasvbox pluto[5203]: "virt"[3] 10.10.10.9 #5: ignoring informational payload, type IPSEC_INITIAL_CONTACT Nov 25 10:45:36 akrasvbox pluto[5203]: "virt"[3] 10.10.10.9 #5: Peer ID is ID_DER_ASN1_DN: 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=Robert Machaczek' Nov 25 10:45:36 akrasvbox pluto[5203]: | subject: 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=Robert Machaczek' Nov 25 10:45:36 akrasvbox pluto[5203]: | issuer: 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=AKRAS CA, E=robert.machaczek(a)akras.at' Nov 25 10:45:36 akrasvbox pluto[5203]: | authkey: c7:b1:4c:dc:97:cb:66:36:95:76:a8:77:32:0e:50:fc:2d:84:01:72 Nov 25 10:45:36 akrasvbox pluto[5203]: | not before : Dec 04 15:50:42 UTC 2003 Nov 25 10:45:36 akrasvbox pluto[5203]: | current time: Nov 25 09:45:36 UTC 2004 Nov 25 10:45:36 akrasvbox pluto[5203]: | not after : Dec 01 15:50:42 UTC 2013 Nov 25 10:45:36 akrasvbox pluto[5203]: | certificate is valid Nov 25 10:45:36 akrasvbox pluto[5203]: | issuer cacert found Nov 25 10:45:36 akrasvbox pluto[5203]: | signature algorithm: 'md5WithRSAEncryption' Nov 25 10:45:36 akrasvbox pluto[5203]: | certificate signature is valid Nov 25 10:45:36 akrasvbox pluto[5203]: | issuer crl found Nov 25 10:45:36 akrasvbox pluto[5203]: | signature algorithm: 'md5WithRSAEncryption' Nov 25 10:45:36 akrasvbox pluto[5203]: | crl signature is valid Nov 25 10:45:36 akrasvbox pluto[5203]: | serial number: 07 Nov 25 10:45:36 akrasvbox pluto[5203]: | certificate not revoked Nov 25 10:45:36 akrasvbox pluto[5203]: "virt"[3] 10.10.10.9 #5: crl update is overdue since Dec 19 12:16:58 UTC 2003 Nov 25 10:45:36 akrasvbox pluto[5203]: | subject: 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=AKRAS CA, E=robert.machaczek(a)akras.at' Nov 25 10:45:36 akrasvbox pluto[5203]: | issuer: 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=AKRAS CA, E=robert.machaczek(a)akras.at' Nov 25 10:45:36 akrasvbox pluto[5203]: | authkey: c7:b1:4c:dc:97:cb:66:36:95:76:a8:77:32:0e:50:fc:2d:84:01:72 Nov 25 10:45:36 akrasvbox pluto[5203]: | not before : Nov 19 11:08:25 UTC 2003 Nov 25 10:45:36 akrasvbox pluto[5203]: | current time: Nov 25 09:45:36 UTC 2004 Nov 25 10:45:36 akrasvbox pluto[5203]: | not after : Nov 17 11:08:25 UTC 2013 Nov 25 10:45:36 akrasvbox pluto[5203]: | certificate is valid Nov 25 10:45:36 akrasvbox pluto[5203]: | issuer cacert found Nov 25 10:45:36 akrasvbox pluto[5203]: | signature algorithm: 'md5WithRSAEncryption' Nov 25 10:45:36 akrasvbox pluto[5203]: | certificate signature is valid Nov 25 10:45:36 akrasvbox pluto[5203]: | reached self-signed root ca Nov 25 10:45:36 akrasvbox pluto[5203]: "virt"[3] 10.10.10.9 #5: no suitable connection for peer 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=Robert Machaczek' Nov 25 10:45:36 akrasvbox pluto[5203]: "virt"[3] 10.10.10.9 #5: sending encrypted notification INVALID_ID_INFORMATION to 10.10.10.9:500 Nov 25 10:45:36 akrasvbox pluto[5203]: | state transition function for STATE_MAIN_R2 failed: INVALID_ID_INFORMATION Nov 25 10:45:36 akrasvbox pluto[5203]: | next event EVENT_RETRANSMIT in 7 seconds for #5 As you can see i also tried to put in the excact Distinguished name into the ipsec.conf to autheticate the user cert. I tried to use the fixed IP-Address but this would fit my need to stay as a road warrior as i understand it. another very strange thing is that the ipsec whack --status command outputs that ipsec connection as established gate:/etc# ipsec whack --status 000 interface ipsec0/eth0 80.120.177.66 000 %myid = (none) 000 debug control 000 000 "virt": 192.168.1.0/24===80.120.177.66[C=AT, ST=Some-State, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=gate.akras.at]---80.120.177.65...%any[C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=Robert Machaczek]==={192.168.2.0/24}; unrouted; eroute owner: #0 000 "virt": CAs: 'C=AT, L=Biedermannsdorf, O=AKRAS Flavours AG, CN=AKRAS CA, E=robert.machaczek(a)akras.at'...'%any' 000 "virt": ike_life: 3600s; ipsec_life: 28800s; rekey_margin: 540s; rekey_fuzz: 100%; keyingtries: 1 000 "virt": policy: RSASIG+ENCRYPT+TUNNEL+PFS; prio: 24,24; interface: eth0; 000 "virt": newest ISAKMP SA: #0; newest IPsec SA: #0; 000 000 but the eroute for the virtual ip is missing.... I am really at the end of my ideas ... google also didn't helped me much. If any1 can help me I would be very appreciated. If you have further questions please ask i will provide you with any information if you can help greetings markus ******************************************************* Käfer Markus LOGIN Ges.m.b.H -Software Beratung Training Gumpendorferstraße 65 A-1060 Wien Mail: markus_kaefer(a)log.at Web: www.log.at Tel: 0043 1 586 58 97 Fax: 0043 1 586 58 97 50 *******************************************************

1 0

Re: AW: [suse-security] Cross Platform Java Plugin Security Risk
by Tiscali Gary D Chance 25 Nov '04

25 Nov '04

On Thursday 25 November 2004 08:55, you wrote: > well, here is a german resource, hope it helps ... :-( > > http://www.heise.de/security/dienste/browsercheck/tests/java.shtml > > /martin > > SULIS GmbH > Kumpfmühler Strasse 10 > 93047 Regensburg > > Tel: +49 8637 985806 > Fax: +49 8637 985808 > Mobil: +49 160 98943453 <snipped for space> Danke Martin und Guido The Konqueror tools translator using Alta Vista Babelfish enabled me to read the web page in English and determine that I was vulnerable by not having Java version 1-4.2_06 where this is fixed. "Sie sind verwundbar" was the message. Ouch. I believe the highlighted box said that I had 1-4.2_05. But, Java can be turned off in the meantime while working out the upgrade means. I've just upgraded to SuSE 9.2. Does this mean everyone is vulnerable? Gary

1 0

data backup; my security risks.
by piet 25 Nov '04

25 Nov '04

dear group, Can you give me some insight on how to store data (photos) savely and what kind of procedure I can follow best. We produce about 200Gig raw images a year. the workflow now is: work on a XP-box and copy the raw's and the jpeg's to a SuSE-box with winscp as a backup on removable harddisks. (I stopped making cd-s as we produce to much data, storing raw's and jpeg's) Will the removable disks last (ide western-digital)? now and again they're used on the system. We were used to shoot on slide film, now our entire workflow has changed and it troubles me to meet the time when images can't be retreived. regards, piet

8 8

[Re: [suse-security] Using 9.1 RPMs on 9.2]
by Philippe Vogel 22 Nov '04

22 Nov '04

Lucky Leavell schrieb: > I notice that many packages which were available on 9.1 are no longer > available from SuSE on 9.2, e.g., snort and nessus. Would it be safe > to download the 9.1 packages (snort.rpm and nessus-core.rpm)? Are > there any plans to increase the number of 9.2 packages available? > > > Thank you, > Lucky Leavell > > So why there are differences between CD and DVD anyway? 5CD's = 3.5 GB/DVD = 4.7 GB O.K., but why are there any packages missing? Before there were 7 CD's. Imo there should not be any differences on both media depending on if you have a dvd or cd drive. Philippe

5 8

Bluetooth
by Franck 20 Nov '04

20 Nov '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I'l searching for doc and/or module on usb bluetooth adaptater. Google is poor on doc with Linux :( linux:/usr/src/linux # lsusb Bus 003 Device 001: ID 0000:0000 Bus 002 Device 001: ID 0000:0000 Bus 001 Device 010: ID 0a5c:3503 Broadcom Corp. Bus 001 Device 009: ID 0a5c:3502 Broadcom Corp. Bus 001 Device 008: ID 0a5c:200a Broadcom Corp. Bus 001 Device 007: ID 0a5c:3535 Broadcom Corp. Bus 001 Device 002: ID 0451:1446 Texas Instruments, Inc. TUSB2040/2070 Hub Bus 001 Device 001: ID 0000:0000 ################### Bluetooth Transceiver Vendor Id 0a5c Product Id 200a Regards Franck -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFBn0DG1zwfep5k9qERAqtYAKCVM6WHlOGmFDKegnGWjH1GOT8phQCfYBNT pmqRD0cs1qRVrOhQUXkTFpw= =Ikqk -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Using 9.1 RPMs on 9.2
by GarUlbricht7＠netscape.net 20 Nov '04

20 Nov '04

Lucky Leavell wrote on Fri Nov 19 2004 - 19:37:04 CET : > > I notice that many packages which were available on 9.1 > are no longer available from SuSE on 9.2, > e.g., snort and nessus. [...] > Are there any plans to increase the number of 9.2 packages available? > Anders Johansson wrote in reply that both snort and nessus are available on the 9.2 DVDs (though not on the CDs). <http://lists.suse.com/archive/suse-security/2004-Nov/0083.html> This generated lots of comments about what was right, and whether there should be manuals, and pretty packages, etc. etc. But I think we all can agree that bottom line we want to know what is coming down the road to we can plan accordingly. In this case, I think it would be wise for me to consider adding a DVD player. to my system, if I want to efficiently run the professional edition of SUSE-9.2. I would also hope that Togan would put in his unofficial SuSE FAQ that SUSE has more rpms on the SUSE-9.2 DVDs than on the 9.2 CDs. And given that, what I did is send some feedback to SUSE at: http://www.novell.com/linux/suse/ to the effedt that they should let people know the 9.2 DVDs have more rpms than the CD -- and that trend is going to contiue on the next edition coming out next spring. We all know that most of our feed back goes into a black hole, even so, it's a start. HTH -- "Just because the message may never be received does not mean it is not worth sending." -- __________________________________________________________________ Switch to Netscape Internet Service. As low as $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Re: [Re: [suse-security] Using 9.1 RPMs on 9.2]
by Philippe Vogel 20 Nov '04

20 Nov '04

Scott Leighton schrieb: > On Friday 19 November 2004 2:20 pm, Geoffrey wrote: > > >> Well, we'll just have to disagree. The price for the pro version has >> risen. Further, I'd rather see consistency between the medias and let >> them keep their pretty packaging. Book to, for that matter. >> >> > > > No way, the books are a critical part of the package. Dropping > either of them from the package severely devalues it. > > I'd rather see them drop the CD's and not use these > dual layer DVDs, just put everything on 4 - 5 DVDs. > > Scott > > a) You talk of 4-5 double layered DVD's? You know that this is 9.4 GB x 5 = 47GB. The files are all shrinked wth rpm and I can't calculate how much 47GB will be unpacked (depends on the content). b) It's not the fact of business reasons. The fact is I buy a product containing free software and some commercial software. Linux is linux is linux. If I buy a product I don't want to be discriminated, because I don't have a DVD on my PC. I buy a product for meanwhile € 80,- (9.2 seen for that price at atelco computer). I buy a product and want to get the full content and I buy a product containing the label "professional". It's unprofessional to leave out some content in this way. There are other ways to distribute missing contents (e.g. via internet) like debian does and automated within the setup. If there are differences this should be printed out on the package (e.g. if you use the CD-version you will not get all packages). This is my personal opinion. Philippe

1 0

spamassassin
by Stefan Suurmeijer 19 Nov '04

19 Nov '04

Hi list, I guess mail security is security too. I just upgraded to SuSE 9.2 (looks fine btw), had everything running until I upgraded spamassassin through CPAN. Now I get the following, very annoying and not very informative error: ERROR! spamassassin script is v3.000000, but using modules v3.000001! Can anyone give me a hint as to what might be causing this? So: SuSE 9.2, with the latest spamassassin release TIA Stefan

4 3