March 2004 - openSUSE Security - openSUSE Mailing Lists

Iptables affected by h323-vulnerability
by Thorsten Büker 26 Mar '04

26 Mar '04

Dear all, According to a security advice published by DFN-CERT [1] in january we deactivated iptables-based forwarding of h323-connections on our gateway. This service was based h323_conntrack-module for kernel 2.4.20, built from latest patch-o-matic. We consider to use video-conferencing again, because netfilter [3] still didn't publish any information whether iptables are affected by this leak. Does anybody of you know the opposite, i.e. iptables are affected by this vulnerability? [1] -> http://cert.uni-stuttgart.de/archive/win-sec-ssc/2004/01/msg00033.html [2] -> http://www.netfilter.org/security/index.html Thanks in advance and kind regards, Thorsten -- Thorsten Büker * Bärenstr. 19-21 / WG 3106 * 52064 Aachen Tel 0241 - 8865315 * Mobil 0163 - 2572057 * http://bueker.net

1 0

Re: [suse-security] Suse 8.2 firewall configuration: blocking port 25 from the internal network
by Wilfred van Velzen 26 Mar '04

26 Mar '04

>>> Arjen de Korte <suse-security(a)de-korte.org> 2004-03-22 20:22:00 >>> > On Monday 22 March 2004 09:05, Wilfred van Velzen wrote: > > > Our policy is to let anything go out. ;-) > > That's not a policy. That's unrestricted access by default and trying to plug > all the holes you leave open. Rest assured, your users will find ways around > your blockade in no time (there are plenty forwarders available). In time > you'll find that closing everything by default and opening what's allowed to > be far easier (and secure) to administrate. This blockage was just to prevent accidental virus contaminations to bother the outside internet, not to prevent users to do certain things. > > I changed this to: > > > > iptables -A forward_int -s 192.168.0.1 -p tcp --dport 25 -j ACCEPT > > iptables -A forward_int -p tcp --dport 25 -j REJECT > > > > Because our email server needs to be able to go through! > > Since you have left everything wide open, you could put all of this in one > line: > > iptables -A forward_int -s ! 192.168.0.1/32 -p tcp --dport 25 -j DROP Ok. Do I need to specify the interface here? Or won't this prevent smtp connections from the outside to reach the mailserver on the inside? > It is almost always better to DROP connections, than to REJECT them. Since the > SuSEfirewall2 scripts provides a pretty CPU intensive set of rules by > default, it makes sense to keep your own additions as limited as possible. On the outside sure, but on the inside of a firewall? I want to keep the machine's on the inside running as fast as possible. Dropping might slow them down a bit... Met vriendelijke groet / Best regards, Wilfred van Velzen -- SERCOM Regeltechniek b.v. Heereweg 9 2161 AB Lisse Nederland +31 (0)252 416530 (voice) +31 (0)252 419481 (fax) <http://www.sercom.nl/> Op al onze offertes, op alle opdrachten aan ons en op alle met ons gesloten overeenkomsten zijn toepasselijk de METAALUNIEVOORWAARDEN, gedeponeerd ter Griffie van de Rechtbank te Rotterdam, zoals deze luiden volgens de laatstelijk aldaar neergelegde tekst. De leveringsvoorwaarden worden u op verzoek toegezonden.

2 1

RE: [suse-security] OpenSSL - Nesus Scan
by Urquidi, Julio 25 Mar '04

25 Mar '04

I had the same question about openssh a while ago. Here's the response I got... > I just updated SuSE openssh from 2.9.9p2-141 to 2.9.9p2-154, but Nessus > still reports the following... > > I thought by updating this package, I wouldn't see the alert messages from > Nessus anymore... > > (TEXT basically saying that openssh is not current) > > Is this normal behavior when it comes to SSH on SuSE? Why does it continue > to show as a problem? Yes, this is normal behavor. NESUS only checks the Service-Version to validate if the service is exploitable or not. NESUS does not try a exploit at all. But our actual ssh-version includes all necesary patches to make ssh secure. The patches are backported to our released ssh-version, because we does not release new version without complete code audit. with kind regards, your SUSE LINUX Support Services-Team -----Original Message----- From: Eric Kahklen [mailto:eric@kahklen.com] Sent: Thursday, March 25, 2004 9:26 AM To: Suse-Security Subject: [suse-security] OpenSSL - Nesus Scan I just ran a nessus scan and it showed OpenSSL vulnerable even though I updated my server when the security fix cam out. Here is the results for OpenSSL. I checked my version and it is OpenSSL 0.9.7b 10 Apr 2003. Either I didn't get my correct version or the update didn't apply. Here is what Nesus said: results|10.0.0|10.0.0.4|https (443/tcp)|11875|Security Hole|The remote host seem to be running a version of OpenSSL which is older than 0.9.6k or 0.9.7c. \n\nThere is a heap corruption bug in this version which might be exploited by an\nattacker to gain a shell on this host.\n\nSolution : If you are running OpenSSL, Upgrade to version 0.9.6k or 0.9.7c or newer\nRisk factor : High\nCVE : CVE-2003-0543, CVE-2003-0544, CVE-2003-0545\nBID : 8732\nOther references : IAVA:2003-A-0027, RHSA:RHSA-2003:291-01, SuSE:SUSE-SA:2003:043\n results|10.0.0|10.0.0.4|www (80/tcp)|11853|Security Warning|\nThe remote host appears to be running a version of Apache 2.x which is older \nthan 2.0.48.\n\nThis version is vulnerable to a bug which may allow a rogue CGI to disable\nthe httpd service by issuing over 4K of data to stderr.\n\nTo exploit this flaw, an attacker would need the ability to upload a rogue\nCGI script to this server and to have it executed by the Apache daemon (httpd).\n\nSolution : Upgrade to version 2.0.48 when it is available\nSee also : http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22030 \nRisk factor : Low\nCVE : CVE-2002-0061, CAN-2003-0789, CAN-2003-0542\nBID : 8926\n Thank you, Eric -- ______________________________________________________________________ Eric Kahklen Seattle, WA -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

OpenSSL - Nesus Scan
by Eric Kahklen 25 Mar '04

25 Mar '04

I just ran a nessus scan and it showed OpenSSL vulnerable even though I updated my server when the security fix cam out. Here is the results for OpenSSL. I checked my version and it is OpenSSL 0.9.7b 10 Apr 2003. Either I didn't get my correct version or the update didn't apply. Here is what Nesus said: results|10.0.0|10.0.0.4|https (443/tcp)|11875|Security Hole|The remote host seem to be running a version of OpenSSL which is older than 0.9.6k or 0.9.7c. \n\nThere is a heap corruption bug in this version which might be exploited by an\nattacker to gain a shell on this host.\n\nSolution : If you are running OpenSSL, Upgrade to version 0.9.6k or 0.9.7c or newer\nRisk factor : High\nCVE : CVE-2003-0543, CVE-2003-0544, CVE-2003-0545\nBID : 8732\nOther references : IAVA:2003-A-0027, RHSA:RHSA-2003:291-01, SuSE:SUSE-SA:2003:043\n results|10.0.0|10.0.0.4|www (80/tcp)|11853|Security Warning|\nThe remote host appears to be running a version of Apache 2.x which is older \nthan 2.0.48.\n\nThis version is vulnerable to a bug which may allow a rogue CGI to disable\nthe httpd service by issuing over 4K of data to stderr.\n\nTo exploit this flaw, an attacker would need the ability to upload a rogue\nCGI script to this server and to have it executed by the Apache daemon (httpd).\n\nSolution : Upgrade to version 2.0.48 when it is available\nSee also : http://nagoya.apache.org/bugzilla/show_bug.cgi?id=22030 \nRisk factor : Low\nCVE : CVE-2002-0061, CAN-2003-0789, CAN-2003-0542\nBID : 8926\n Thank you, Eric -- ______________________________________________________________________ Eric Kahklen Seattle, WA

1 0

Eclipse and SuSE Firewall
by Ivan Yosifov 25 Mar '04

25 Mar '04

Hello All, I am having a big problem with the Java IDE Eclipse - both with the version packed with SuSE 9.0 Pro and with latest 3.0 Milestone.I am posting this message to this particular list because the problem is actually a SuSE Firewall config problem.When starting a debug session with the firewall NOT running everything works fine.However when the firewall is up the first time I run the debugger it displays a "Finding free socket .... 66%" message and looks dead for the next 15 minutes.Eventually it connects and works properly.The next time I start the debugger in the same eclipse session it connects immediately , no waiting.I suspect Eclipse is doing some sort of port-probing to find out where the java remote debugging infrastructure is listening for connections and the firewall is making this scan a VERY slow process.I have experimented with different firewall configs , but no effect.Since localhost is scanning itself this can not be considered an attack.My exact question is : How do it tell the firewall to allow localhost to do ANYTHING with itself and other hosts , ie how do disable any processing on packets comming from localhost. Thanks in advance , I am really desperate. Ivan Yosifov.

2 2

Does it matter?
by suse＠archive.cert.uni-stuttgart.de 25 Mar '04

25 Mar '04

Your photo, uahhh.... , you are naked! [demime 1.1d removed an attachment of type application/octet-stream which had a name of text01_suse-security.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Eclipse and SuSE Firewall
by Ivan Yosifov 24 Mar '04

24 Mar '04

Hello All, I am having a big problem with the Java IDE Eclipse - both with the version packed with SuSE 9.0 Pro and with latest 3.0 Milestone.I am posting this message to this particular list because the problem is actually a SuSE Firewall config problem.When starting a debug session with the firewall NOT running everything works fine.However when the firewall is up the first time I run the debugger it displays a "Finding free socket .... 66%" message and looks dead for the next 15 minutes.Eventually it connects and works properly.The next time I start the debugger in the same eclipse session it connects immediately , no waiting.I suspect Eclipse is doing some sort of port-probing to find out where the java remote debugging infrastructure is listening for connections and the firewall is making this scan a VERY slow process.I have experimented with different firewall configs , but no effect.Since localhost is scanning itself this can not be considered an attack.My exact question is : How do it tell the firewall to allow localhost to do ANYTHING with itself and other hosts , ie how do disable any processing on packets comming from localhost. Thanks in advance , I am really desperate. Ivan Yosifov.

1 0

PLEASE HELP ME. SuSE-FW-ACCESS_DENIED_INT
by Regilberto Girão 24 Mar '04

24 Mar '04

Sorry, I´m sending the question again. Dear Sirs: Please. My customer is using PCANYWHERE to connect, from internal network (10.1.1.11), to external HOST. This service was used until last month without problems. It has two weeks, the service left to function. I´m receiving the follow message, since then: Mar 22 14:25:38 linux kernel: SuSE-FW-ACCESS_DENIED_INT IN=eth0 OUT= MAC=00:e0:7d:c8:19:81:01:03:88:00:bf:1e:08:00 SRC=10.1.1.11 DST=200.X.X.X LEN=30 TOS=0x00 PREC=0x00 TTL=128 ID=57029 PROTO=UDP SPT=3190 DPT=5632 LEN=10 What´s happen? Can you help me? Please. Thank you and best regards. Regilberto Girão

2 1

IPV6 protocol in susfirewall
by Wouter 24 Mar '04

24 Mar '04

Hi, Can someone tell me how i can open the ipv6 protocol in susefirewall or most i write my own iptable rules Greets Wouter

2 1

Traffic from GSM mobile invisible???
by Stefan Gofferje 24 Mar '04

24 Mar '04

Hello list, I have a encountered a very interesting problem and am curious if anybody here has a hint on that. I have a linux firewall / router with iptables. Let's call it defiant with ext ppp0/dynamic and int eht0 192.168.1.254 I have a linux mailserver Let's call it k-tanco with ip 192.168.1.200 I have iptables rules forwarding traffic on port 25 and 143 from defiant ppp0 to k-tanco. So far so good - everything works as supposed. When I telnet defiant from outside to port 25, I see the traffic (tcpdump) both on defiant ppp0 and k-tanco eth0. Now, I have a Nokia Series 60 phone with integrated email client. I set this email client to use the dyndns hostname of defiant via GPRS. I can check mails and send mails via my home server. That was the first strange point. A sending agent must be either use ASMTP, be on 192.168.1.0/24 or deliver mail for the local domains. So, the mailserver should have rejected the mail. While investigating, I found out the following: Incoming connections from the phone do NOT appear on defiant ppp0 (tcpdump). They appear on k-tanco eth0 with source ip 192.168.1.254 - the ip of defiant eth0. /var/log/mail claims, connect from defiant.net.local[192.168.10.254] and the header in the final mail says received from [169.254.0.7] (defiant.net.local[192.168.10.254]). Does anybody has an idea, what's going on here? Regards, Stefan

1 1