February 2004 - openSUSE Security - openSUSE Mailing Lists

Mutt-1.4.2 fixes buffer overflow. (forw)
by Joerg Mayer 12 Feb '04

12 Feb '04

Does this affect Suse 9.0 (mutt 1.4.1i)? Thanks Jörg ----- Forwarded message from Thomas Roessler <roessler(a)does-not-exist.org> ----- Mailing-List: contact bugtraq-help(a)securityfocus.com; run by ezmlm Delivered-To: mailing list bugtraq(a)securityfocus.com Delivered-To: moderator for bugtraq(a)securityfocus.com Date: Wed, 11 Feb 2004 15:21:14 +0100 From: Thomas Roessler <roessler(a)does-not-exist.org> To: BUGTRAQ(a)securityfocus.com Subject: Mutt-1.4.2 fixes buffer overflow. Mail-Followup-To: BUGTRAQ(a)securityfocus.com Mutt-1.4.2 has just been released; this version fixes a buffer overflow that can be triggered by incoming messages. There are reports about spam that has actually triggered this problem and crashed mutt. It is recommended that users of mutt versions prior to 1.4.2 upgrade to this version, or apply the patch included below. Users of "unstable" mutt versions after 1.3.28 (including 1.5.*) do not need to upgrade, as this problem had been fixed in the unstable branch in February 2002; unfortunately, the fix was not backported before 1.4 was released. mutt-1.4.2 can be found at ftp://ftp.mutt.org/mutt/. Distribution files: MD5 checksum file name size 44fc379c317109f516894a7c3fd43cc9 diff-1.4.1i-1.4.2i.gz (23k) 6045b47cbba8170d6a9fdccc1aa817b9 mutt-1.4.2i.tar.gz (2.4M) Linux distributors are expected to release updated mutt packages shortly. Credits: The problem in the stable mutt code base was originally reported to Red Hat, and was brought to my attention by Mark Cox. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0078 to this issue. Regards, -- Thomas Roessler · Personal soap box at <http://log.does-not-exist.org/>. Index: menu.c =================================================================== RCS file: /cvs/mutt/mutt/menu.c,v retrieving revision 2.27.2.1 diff -u -r2.27.2.1 menu.c --- menu.c 28 Jan 2002 10:18:50 -0000 2.27.2.1 +++ menu.c 11 Feb 2004 10:05:52 -0000 @@ -148,30 +148,13 @@ menu->make_entry (s, l, menu, i); } -void menu_pad_string (char *s, size_t l) +void menu_pad_string (char *s, size_t n) { - size_t n = mutt_strlen (s); int shift = option (OPTARROWCURSOR) ? 3 : 0; - - l--; /* save room for the terminal \0 */ - if (l > COLS - shift) - l = COLS - shift; + int cols = COLS - shift; - /* Let's just pad the string anyway ... */ - mutt_format_string (s, INT_MAX, l, l, 0, ' ', s, n, 1); - return; - -#if !defined (HAVE_BKGDSET) && !defined (USE_SLANG_CURSES) - /* we have to pad the string with blanks to the end of line */ - if (n < l) - { - while (n < l) - s[n++] = ' '; - s[n] = 0; - } - else -#endif - s[l] = 0; + mutt_format_string (s, n, cols, cols, 0, ' ', s, strlen (s), 1); + s[n - 1] = 0; } void menu_redraw_full (MUTTMENU *menu) ----- End forwarded message ----- -- Joerg Mayer <jmayer(a)loplof.de> We are stuck with technology when what we really want is just stuff that works. Some say that should read Microsoft instead of technology.

3 2

unsuscribe
by Stefano Bertotti 12 Feb '04

12 Feb '04

Unsuscribe

1 0

RE: [suse-security] Grep uncomment lines from .conf
by José Luis Ledesma 12 Feb '04

12 Feb '04

egrep -v "^[ ^I]*#\|^[ ^I]*$" file.conf ^I=ctrl+V & ctrl+I with this way we make sure that there are not fuc***** spaces before de # or de eol regards, José Luis Ledesma _______________ Competitiveness Telephone: +34 669 86 55 39 Email: jledesma(a)competitiveness.com <mailto:jledesma@competitiveness.com> Website: http://www.competitiveness.com -----Original Message----- From: Arie Reynaldi Zanahar [mailto:reyman@reynaldi.com] Sent: jueves, 12 de febrero de 2004 4:04 To: suse-security(a)suse.com Subject: [suse-security] Grep uncomment lines from .conf Dear, I want to grep lines that not commented from a file, Someone said that I can use $sed -e '/^[[:space:]]*#/d;/^[[:space:]]*$/d' file.conf but I think it's too long, I have use $egrep -v '^#' file.conf but it containt so many blank lines. Is there any suggest what should I use ? Maybe like combining egrep with other script.. As simple as possible :) regards, -- Arie Reynaldi Zanahar reyman(a)reynaldi.com -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Grep uncomment lines from .conf
by m3047＠inwa.net 12 Feb '04

12 Feb '04

Is this security related? I apologize in advance. At 10:04 AM 2/12/04, Arie Reynaldi Zanahar wrote: >I want to grep lines that not commented from a file, Someone said that I can m3047@flame:~/perl> cat source.txt # This is a comment this is indented # this is an indented comment q.e.d. m3047@flame:~/perl> perl -wn -e 'm/^\s*[^#\s]/ && print;' source.txt this is indented q.e.d. m3047@flame:~/perl> (with a nod to Tim Maher) -- Fred Morris fredm3047(a)inwa.net (I-ACK)

1 0

unsubscription
by Wolfgang Hanzl 11 Feb '04

11 Feb '04

unsubscription

2 1

RE: Setting up a chroot ssh login
by Tom Knight 11 Feb '04

11 Feb '04

> Dear Thomas, > > doing a google search I found your post > > http://archives.neohapsis.com/archives/linux/suse/2004-q1/0393.html > > Because I'm interested in setting up a chroot ssh login, I'd like to know > how you did it. > > Thank you in advance! > > > Best regards, > > Martin No probs... I hope you don't mind, but I'm also sending it to the list which you found on Google. To those on the list who helped me get this set up - thanks!! As it happens, I've now moved away from the chroot login, but it did work very well (as far as I could tell). Here's what I had: I installed the "compart" (or was it "compartment"?) package from Yast. /etc/passwd contained: update:x:5000:65534:Update User:/home/update:/bin/compart.jail I used /home/update/JAIL not /home/update as /home/update/.ssh/authorised_keys contained the stuff to enable a passwordless login. /bin/compart.jail contained: #!/bin/bash sudo /usr/sbin/compartment --user update --group nogroup --chroot /home/update/JAIL /bin/bash "$@" /etc/sudoers contained: update ALL= NOPASSWD: /usr/sbin/compartment --user update --group nogroup --chroot /home/update/JAIL /bin/bash* The directory /home/update/JAIL ($JAIL) contained the full set of files that the update user required. `ldd` gave me the libraries that the programs all required, thus: .: total 1 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 . 0 drwxr-xr-x 4 root root 160 2004-01-29 16:03 .. 0 drwxr-xr-x 2 root root 192 2004-01-26 09:57 bin 0 drwxr-xr-x 2 root root 96 2004-01-23 14:08 dev 0 drwxr-xr-x 2 root root 128 2004-01-27 11:23 etc 1 drwxr-xr-x 3 root root 664 2004-01-26 09:55 lib 0 drwxr-xr-x 4 root root 112 2004-01-22 09:33 upload 0 drwxr-xr-x 4 root root 96 2004-01-22 14:50 usr ./bin: total 645 0 drwxr-xr-x 2 root root 192 2004-01-26 09:57 . 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 .. 469 -rwxr-xr-x 1 root root 477132 2004-01-20 15:02 bash 68 -rwxr-xr-x 1 root root 68460 2004-01-20 15:02 ls 20 -rwxr-xr-x 1 root root 18928 2004-01-20 15:02 mkdir 52 -rwxr-xr-x 1 root root 52184 2004-01-20 15:02 mv 8 -rwxr-xr-x 1 root root 6096 2004-01-20 15:02 pwd 28 -rwxr-xr-x 1 root root 26656 2004-01-20 15:02 rm ./dev: total 0 0 drwxr-xr-x 2 root root 96 2004-01-23 14:08 . 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 .. 0 crw-rw-rw- 1 root root 5, 0 2004-01-22 14:39 tty 0 crw-r--r-- 1 root root 1, 9 2004-01-20 16:00 urandom ./etc: total 12 0 drwxr-xr-x 2 root root 128 2004-01-27 11:23 . 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 .. 4 -r-------- 1 root root 27 2004-01-22 16:11 group 4 -rw-r--r-- 1 root root 1722 2004-01-21 09:08 ld.so.cache 4 -r-------- 1 root root 65 2004-01-22 16:12 passwd ./lib: total 1789 1 drwxr-xr-x 3 root root 664 2004-01-26 09:55 . 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 .. 0 drwxr-xr-x 2 root root 112 2004-01-23 14:08 i686 92 -rwxr-xr-x 1 root root 91085 2004-01-22 14:47 ld-linux.so.2 28 -rwxr-xr-x 1 root root 25416 2004-01-20 15:02 libacl.so.1 16 -rwxr-xr-x 1 root root 13974 2004-01-20 15:02 libattr.so.1 8 -rwxr-xr-x 1 root root 7518 2004-01-22 16:05 libcom_err.so.2 44 -rwxr-xr-x 1 root root 43395 2004-01-22 14:47 libcrypt.so.1 12 -rwxr-xr-x 1 root root 11856 2004-01-20 15:02 libdl.so.2 104 -rwxr-xr-x 1 root root 104452 2004-01-22 16:05 libext2fs.so.2 124 -rwxr-xr-x 1 root root 122891 2004-01-20 15:02 libhistory.so.4 304 -rwxr-xr-x 1 root root 307598 2004-01-20 15:02 libncurses.so.5 88 -rwxr-xr-x 1 root root 87717 2004-01-22 14:47 libnsl.so.1 52 -rwxr-xr-x 1 root root 50541 2004-01-21 09:11 libnss_compat.so.2 44 -rwxr-xr-x 1 root root 44639 2004-01-21 09:13 libnss_files.so.2 637 -rwxr-xr-x 1 root root 650278 2004-01-20 15:02 libreadline.so.4 72 -rwxr-xr-x 1 root root 70056 2004-01-22 14:47 libresolv.so.2 36 -rwxr-xr-x 1 root root 34085 2004-01-20 15:02 librt.so.1 12 -rwxr-xr-x 1 root root 10600 2004-01-22 14:47 libutil.so.1 52 -rwxr-xr-x 1 root root 52751 2004-01-21 11:35 libxcrypt.so.1 64 -rwxr-xr-x 1 root root 61850 2004-01-22 14:47 libz.so.1 ./lib/i686: total 1390 0 drwxr-xr-x 2 root root 112 2004-01-23 14:08 . 1 drwxr-xr-x 3 root root 664 2004-01-26 09:55 .. 1289 -rwxr-xr-x 1 root root 1315242 2004-01-20 15:02 libc.so.6 100 -rwxr-xr-x 1 root root 98628 2004-01-20 15:02 libpthread.so.0 ./usr: total 0 0 drwxr-xr-x 4 root root 96 2004-01-22 14:50 . 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 .. 0 drwxr-xr-x 2 root root 192 2004-01-26 09:56 bin 0 drwxr-xr-x 2 root root 280 2004-01-23 14:08 lib ./usr/bin: total 504 0 drwxr-xr-x 2 root root 192 2004-01-26 09:56 . 0 drwxr-xr-x 4 root root 96 2004-01-22 14:50 .. 8 -rwxr-xr-x 1 root root 6056 2004-01-22 16:03 env 4 -rw-r--r-- 1 root root 19 2004-01-20 15:00 groups 12 -rwxr-xr-x 1 root root 9400 2004-01-20 15:02 id 192 -rwxr-xr-x 1 root root 196256 2004-01-20 15:02 rsync 32 -rwxr-xr-x 1 root root 28772 2004-01-22 14:33 scp 256 -rwxr-xr-x 1 root root 260976 2004-01-20 15:02 ssh ./usr/lib: total 2221 0 drwxr-xr-x 2 root root 280 2004-01-23 14:08 . 0 drwxr-xr-x 4 root root 96 2004-01-22 14:50 .. 148 -rwxr-xr-x 1 root root 147873 2004-01-22 14:48 libasn1.so.5 8 -rwxr-xr-x 1 root root 7801 2004-01-22 14:48 libcom_err.so.1 941 -r-xr-xr-x 1 root root 961852 2004-01-22 14:47 libcrypto.so.0.9.6 729 -rwxr-xr-x 1 root root 744626 2004-01-22 14:48 libdb-4.0.so 52 -rwxr-xr-x 1 root root 53230 2004-01-22 14:48 libgssapi.so.1 260 -rwxr-xr-x 1 root root 263374 2004-01-22 14:48 libkrb5.so.17 84 -rwxr-xr-x 1 root root 84253 2004-01-22 14:48 libroken.so.9 upload/: total 0 0 drwxr-xr-x 4 root root 112 2004-01-22 09:33 . 0 drwxr-xr-x 8 root root 192 2004-01-27 09:54 .. 0 drwxr-xr-x 7 update nogroup 256 2004-02-09 23:04 catalogue 0 drwxrwxrwx 2 update nogroup 48 2004-01-30 08:35 publicsite $JAIL/etc/passwd contained: root:x:0:0:root:/root:/bin/bash update:x:5000:65534::/:/bin/bash $JAIL/etc/group contained: root:x:0: nogroup:x:65534: I think my biggest problem was tweaking the sudoers and the conmpart.jail files to work properly together. Possible improvements and other security thoughts: 1. I think to make it more secure I'd put it in a separate partition, with appropriate security options set. The only problem is that given that this user would be allowed to upload files (to $JAIL/upload/catalogue and $JAIL/upload/publicsite), I wouldn't be able to make it readonly. 2. PAM was to be used to limit upload's logon times to certain times of day, and to only allow root@other_host to login as update. This wouyld mean that the other machine would have to be root-compromised to let an unauthorised user log in to the chroot jail. 3. A cron job that performs and compares checksums on files in $JAIL, replacing them if required (and reporting if this happens). 4. The files uploaded by the update user are copied out of the jail undergo a set of sanity checks and are _then_ put in place of the current website and catalogue. 5. I though about using `chattr` to make files really difficult to modify, but I find out much about it before I discovered that it's not so available for ReiserFS. The reason I'm not using this system now is that I couldn't get rsync to work, and if I'm reduced to having all files uploaded I may as well use sftp and have no direct shell access whatsoever. Hell, it's only bandwidth! Tom.

2 2

Re: [suse-security] sendmail/amavis.
by Marc Samendinger 10 Feb '04

10 Feb '04

> -----Original Message----- > From: elfed lewis [mailto:e.lewis@meirion-dwyfor.ac.uk] > Sent: Tuesday, February 10, 2004 3:20 PM > > Hi There, > > Im using sendmail and amavis on a suse 9.0 (32 bit) machine > along with sophos > antivirus. > > Ive said yes to the "use amavis" in the amavis file inside > /etc/sysconfig. > Amavis starts up fine, sendmail starts up fine (without any > error messages). > ive configured amavisd.conf as per the instructions in /usr/share/doc/ > packages/amavis. Ive also run /etc/SuSEconfig to recreate > any neccessary > conf files, and then rebooted the server. but when i send > the eicar test > virus, it doesnt virus scan at all! But no errors, nothing > saying amavis or > sendmail have a problem. Sendmail just ISNT sending the > email to amavis! > > Any ideas what i am doing wrong? What about AMAVIS_SENDMAIL_MILTER in /etc/sysconfig/amavis? > Id attach the config files, but im assuming that this mailing > list would chop > them off? > > Hwyl, > Elf marc

2 1

Logging trouble
by remote 10 Feb '04

10 Feb '04

Hi ! How can I keep SuSEfirewall2 from writing its logs into /var/log/messages. There are so many messages of the firewall there that I have trouble finding the system messages ! I thought it was only supposed to log into /var/log/firewall ?

3 2

Opening SMTP for Postfix
by Eric Kahklen 09 Feb '04

09 Feb '04

I just installed SuSE 9.0 with Postfix and am trying to test connectivity by telneting to port 25 and get a connection refused. Scanning the box with NMAP shows port 25 closed. If I telnet to localhost on port 25 from the box I connect with the mail system prompt. I tried running the firewall tool in yast2 to allow SMTP but still no luck. Does anyone know where to check to see where I can open this port? Thanks, Eric

7 10

hi
by steffen＠dett.de 09 Feb '04

09 Feb '04

The message contains Unicode characters and has been sent as a binary attachment.

1 0