April 2004 - openSUSE Security - openSUSE Mailing Lists

ip_setsockopt() msfilter exploit
by Philippe Vogel 23 Apr '04

23 Apr '04

Hi! What's with the ip_setsockopt() exploit: http://isec.pl/vulnerabilities/isec-0015-msfilter.txt Are there any patches yet? Which versions of SuSE-Linux are vulnerable? Philippe

1 0

Unwanted file deletion
by Keith Hopper 22 Apr '04

22 Apr '04

Greetings, I believe that the subject of this note might come under the aegis of security - as I have certainly lost some files due to some SuSE configuration script or other. For many months now I have had a soft link from /etc/gtk-2.0 to the directory containing - among other things - the file gdk-pixbuf.loaders which is central to the graphic display of the ROX Filer system. Imagine my horror this morning when loggging on, to receive an error message from the ROX filer indicating that it could not find the file /etc/gtk-2.0/gdk-pixbuf.loaders. Opening an X terminal was kindly done by ROX Session and I discovered to my horror that the directory /etc/gtk-2.0 was now a real directory with a file REMOVE_IN_PROGRESS in it. Now the message in that file indicated that some gnome software was now to be found in /opt/gnome (which doesn't really concern me) but that I should re-install everything else - but it didn't care to indicate what 'else' might be involved. I found a copy of the original gdk-pixbuf.loaders file and re-made the link - but am rather worried that not only the link was destroyed - but also the contents of the directory to which it was pointing when YaST re-built yesterday (after uninstalling a superceded version of Amaya). This seems to me to be an integrity problem which comes under security so far as I am concerned. I presume others have had this happen too. What must be done to stop this automagic file removal?? I don't want to lose all of some vital package due to actions being taken behind my back! Keith Hopper -- City Desk Waikato University [PGP key available if desired]

3 3

SuSEfirewall2 and DHCP in DMZ
by Barry Gill 22 Apr '04

22 Apr '04

Hello All, I wish to set up a SuSEfirewall2 server acting as a NAT gateway wiht three interfaces. I have a Lucent firewall connecting to the web but want to be able to set up access rules on who on my internal LAN can access which of my servers. My question is, how do I configure SuSEfirewall2 so that my DMZ (eth1) and my LAN (eth2) are a) both in the same subnet, b) DHCP server in the DMZ is available for DHCP requests from LAN workstations, and c) enable Netbios over TCP traffic to move through the eth2 to eth1 (and vice versa) ports. Essentially this box will be doing NOTHING other than NAT and routing between the three ports. any help would be appreciated. Thanks Barry

1 0

how about the new multicast kernel exploit?
by Andreas Bittner 21 Apr '04

21 Apr '04

http://www.isec.pl/vulnerabilities04.html any upcoming patches? thanks and cheers, andy

5 5

Log Entry Quesiton
by Eric Kahklen 19 Apr '04

19 Apr '04

I got this entry in my log and I haven't done any user changes recently. The only thing I've done is run the Yast2 online update for some of the recent security patches. Apr 18 10:15:17 gateway usermod[30787]: change user `wwwrun' GID from `8' to `8' Apr 18 10:15:17 gateway usermod[30788]: change user `wwwrun' shell from `/bin/false' to `/bin/false' Thanks, Eric --

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by Marc Samendinger 19 Apr '04

19 Apr '04

> -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: Monday, April 19, 2004 1:00 PM > > > > Check your "services option" in > /etc/sysconfig/SuSefirewall2. FTP ports > must > > be declared in the "EXT" services. > > The ports 20 and 21 are declared in the "EXT" services. > > >Actually it is the other way round. You machine should have > its high ports > >open and the server should have ports 20 and 21 open. 20 and 21 on the server are for active ftp, passive ftp would be 21 and unprivileged port > I don´t get that. I thought passive FTP is used so that I > don´t have to keep > these higher ports open if I only want to download stuff. If > not, what´s the > point ? The point is all the connection are established by your machine. You can use connection tracking to securely open the high ports on your machine "by demand" The imho best explanation about active and passive ftp is http://slacksite.com/other/ftp.html HTH marc

1 0

RE: [suse-security] Configuring SuSEfirewall2 for FTP access
by sematin＠mtn.co.ug 19 Apr '04

19 Apr '04

Opening ports 20 and 21 locally just allows remote users to be able to connect to YOUR ftp server and not the other way round. Noah. > -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: 19 April 2004 14:00 > To: SUSE-SECURITY > Subject: Re: [suse-security] Configuring SuSEfirewall2 for FTP access > > > > > Check your "services option" in /etc/sysconfig/SuSefirewall2. FTP > > ports > must > > be declared in the "EXT" services. > > The ports 20 and 21 are declared in the "EXT" services. > > >Actually it is the other way round. You machine should have its high > >ports open and the server should have ports 20 and 21 open. > > I don´t get that. I thought passive FTP is used so that I > don´t have to keep these higher ports open if I only want to > download stuff. If not, what´s the point ? > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

> Check your "services option" in /etc/sysconfig/SuSefirewall2. FTP ports must > be declared in the "EXT" services. The ports 20 and 21 are declared in the "EXT" services. >Actually it is the other way round. You machine should have its high ports >open and the server should have ports 20 and 21 open. I don´t get that. I thought passive FTP is used so that I don´t have to keep these higher ports open if I only want to download stuff. If not, what´s the point ?

1 0

RE: [suse-security] Configuring SuSEfirewall2 for FTP access
by sematin＠mtn.co.ug 19 Apr '04

19 Apr '04

Actually it is the other way round. You machine should have its high ports open and the server should have ports 20 and 21 open. Noah. > -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: 19 April 2004 12:38 > To: SUSE-SECURITY > Subject: Re: [suse-security] Configuring SuSEfirewall2 for FTP access > > > This is a transcript of my firewall log when I try to connect > to ftp.suse.de : > > Apr 19 11:35:38 router kernel: SuSE-FW-DROP-DEFAULT IN=eth0 > OUT=eth1 SRC=AAA.BBB.CCC.DDD DST=195.135.221.130 LEN=48 > TOS=0x00 PREC=0x00 TTL=127 ID=1263 DF PROTO=TCP SPT=1802 > DPT=38852 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402) > > Passive FTP is activated. The way I understood passive FTP > the server is supposed to have its higher ports open, while > the downloading computer only has to have ports 20 or 21 > open. My /etc/sysconfig/SuSEfirewall does include a > FW_FORWARD-rule which opens these ports to the entire net, > FW_FORWARD =" > AAA.BBB.CCC.0/6,0/0,tcp,20:21 " > > however I don´t get any kind of FTP, neither upload nor download. > > What´s wrong with my setup ? > > Thanks, > > Jörg > >

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

This is a transcript of my firewall log when I try to connect to ftp.suse.de : Apr 19 11:35:38 router kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT=eth1 SRC=AAA.BBB.CCC.DDD DST=195.135.221.130 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=1263 DF PROTO=TCP SPT=1802 DPT=38852 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402) Passive FTP is activated. The way I understood passive FTP the server is supposed to have its higher ports open, while the downloading computer only has to have ports 20 or 21 open. My /etc/sysconfig/SuSEfirewall does include a FW_FORWARD-rule which opens these ports to the entire net, FW_FORWARD =" AAA.BBB.CCC.0/6,0/0,tcp,20:21 " however I don´t get any kind of FTP, neither upload nor download. What´s wrong with my setup ? Thanks, Jörg

1 0