February 2004 - openSUSE Security - openSUSE Mailing Lists

INFECTED Emails over the list
by C. Arnold Kunze 18 Feb '04

18 Feb '04

hallo everybody, today several Emails with the worm W32.Beagle.B@mm arrived my system over the suse - security - list. The worm is also known as: W32.Alua@mm, Win32/Bagle.B.Worm [Computer Associates], Bagle.B [F-Secure], W32/Bagle.b@MM [McAfee], W32/Bagle.B@mm [Norman], WORM_BAGLE.B [Trend Mirco], W32/Bagle.B.worm [Panda], W32/Tanx-A [Sophos]. Three Emails WITH THE malicious attachment came from: poeml(a)suse.de, Four Emails with the same suspicious header but_without_ the attachment came from: tobias(a)weisserth.de john(a)linuxlad.org Robert Schiele Rainer Link(a)trendmicro.de please update Your virusdefs and disinfect Your system!! More information about the worm at BSI, heise.de (in german), Symantec and NAI (in english). The worm spreads until february, 25!! Thank You C. A. Kunze physician Finding virusses, worms or other malware is the job of a physician. In human beeings or even in computer systems

3 2

RE: [suse-security] ID wwywxugwisi... thanks
by Rainer_Link＠trendmicro.de 18 Feb '04

18 Feb '04

That's Bagle.B - jsut in case. best regards, Rainer Link > -----Original Message----- > From: poeml(a)suse.de [mailto:poeml@suse.de] > Sent: Dienstag, 17. Februar 2004 16:46 > To: suse-security(a)suse.com > Subject: [suse-security] ID wwywxugwisi... thanks > > > Yours ID kqniv > -- > Thank > >

9 9

Obscuring OS
by Bill.Light＠kp.org 18 Feb '04

18 Feb '04

I am running a mail/web server and Netcraft says that it is Apache/1.3.28 and (Linux/SuSE). While on one hand that is nice....Would it not be better to obscure which distro I am running and the version of Apache ?? How would one accomplish this ? - Bill

4 3

postgresql suse 9.0
by piet 18 Feb '04

18 Feb '04

sorry: maybe off topic, but I am stuck: postgresql on my 8.0 box start with rcpostgresql, but on my 9.0 box it won't happen? is there some other way to start the server? regards, piet

3 3

AW: [suse-security] ID wwywxugwisi... thanks
by dag Danczul Georg 18 Feb '04

18 Feb '04

-----BEGIN PGP SIGNED MESSAGE----- I agree too. Where, when not in security lists could this done for testing? georg - -----Ursprüngliche Nachricht----- Von: john(a)linuxlad.org [mailto:john@linuxlad.org] Gesendet: Dienstag, 17. Februar 2004 18:50 An: suse-security(a)lists.suse.com Betreff: RE: [suse-security] ID wwywxugwisi... thanks I agree that it's a dumb idea, but these virii don't know and don't care what the purpose of this list is. Someday some nitwit will stumble onto a piece of code that exploits an as-yet undiscovered flaw in one or more linux email clients, and we'll have a small disaster. It's just plain naive to think this will never happen. Perhaps later than sooner, but there is a lot more likelyhood that it will than it won't. Since it does no good to complain without offering a solution, here's an idea: Why not require all messages posted to this list to be signed with the users's gpg key? Building functionality into the list daemon to verify signatures would be easy task and would also help cut back on the spam that invades this list from time to time. Users can supply their public key at subscription time or it can be pulled from a keyserver when the users posts. It's really not a huge inconvenience... I'm signing this post to show how easy it is. Just my modest input... ...... -----BEGIN PGP SIGNATURE----- Version: CryptoEx OpenPGP Engine Version 2.1 Comment: KEBA CryptoEx Business Server - http://www.cryptoex.com iQA/AwUBQDMZ6X+RlK7Q2OA0EQI3vQCgyGBP/lHHXmh8uFLk/FT4T0QsyXgAoI/3 1jCOQq9scpF2z7jxcfkdiGkq =nGkF -----END PGP SIGNATURE-----

2 1

Re: [suse-security] ID wwywxugwisi... thanks
by Arjen de Korte 18 Feb '04

18 Feb '04

On Tuesday 17 February 2004 23:13, Sjag Steensma wrote: > > fact, I'm rejecting these kinds of attachments on incoming e-mail for a > > while (so I missed the e-mail starting this thread). > Good, how did you do that? Postfix header checks is my friend: header_checks = pcre:/etc/postfix/header_checks mime_header_checks = $header_checks The file /etc/postfix/header_checks contains (amongst other filtering rules) the following group of lines (white space IS important here): /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.+\.( 386|ba[st]|bin|c[ho]m|cmd|cpl|dll|drv|exe|hlp|hta| in[fis]|isp|js|jse|lnk|ms[cipt]|ocx|pif|reg|sc[rt]| sh[bs]|sys|url|vb|vb[es]|vxd|ws[cfh]))"?\s*$/ REJECT Attachment file type not allowed ("$2" has the extension ".$3") This will block (almost) all e-mail with (Windows) executable attachments. Best regards, Arjen PS I read this mailinglist too, so there is absolutely no reason to CC me as well. In fact, I usually ignore traffic to this address NOT from the mailinglist server.

1 0

AW: [suse-security] ID wwywxugwisi... thanks
by Rasp, Robert 17 Feb '04

17 Feb '04

Hi, i use qmail with qmailscaner to block executeabel-windows-files. Zipfiles will bes scanned with McAfee... CU Robert -----Ursprüngliche Nachricht----- Von: Sjag Steensma [mailto:suse@pitron.nl] Gesendet: Dienstag, 17. Februar 2004 23:39 An: suse-security(a)suse.com Betreff: Re: [suse-security] ID wwywxugwisi... thanks Hi, > ... > fact, I'm rejecting these kinds of attachments on incoming e-mail for a while > (so I missed the e-mail starting this thread). Good, how did you do that? Regards, Sjag -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

LVM encryption
by Stephane 17 Feb '04

17 Feb '04

When I set up a LVM volume with encryption, boot.crypto returns error, has anybody a solution for this?

1 0

ID auyc... thanks
by poeml＠suse.de 17 Feb '04

17 Feb '04

Yours ID pfuu -- Thank

1 0

ID wwywxugwisi... thanks
by poeml＠suse.de 17 Feb '04

17 Feb '04

Yours ID kqniv -- Thank

1 0