May 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSEFirewall doesn't work?
by Manuel Balderrábano 11 May '04

11 May '04

Hi, thanks for answering. El Martes, 11 de Mayo de 2004 17:53, Tom Kramer escribió: > > > -----Original Message----- > > From: Manuel Balderrábano [mailto:garibolo@wanadoo.es] > > Sent: Tuesday, May 11, 2004 5:42 PM > > To: suse-security(a)suse.com > > Subject: Re: [suse-security] SuSEFirewall doesn't work? > > > > Hi. > > > > Please, please, please... Can anyone tell me how to use PAT > > under SuSEFirewall2? > > > > Sorry for using this thread to ask this, but Tom mentioned it > > and I got nervous because I have been trying it for a while. > > In the end, used squid for apache, but I found nothing for > > ssh and cvs, so that I have to check the firewall along with > > both the ssh , the cvs and snort logs. > > I don't know what you want to do exactly but check this: > > http://www.sun.com/bigadmin/content/submitted/squid_proxy.html What I need is to redirect all incoming connections on port 80 to another computer on the DMZ. > > Maybe this is the answer you are looking for: > > ".... > > You probably have a more sophisticated NetFilter setup. However, there is > one line that you need to redirect inbound traffic on port 80 to Squid on > port 3128: > > iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT > --to-ports 3128 I do that just by using port 80 on squid, but I would need to do something like: iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-host X.Y.Z.T (I made up that --tol-host rule) Regards. > > ...." > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > -- --------------------------------------------------------------------------------- Manuel Balderrábano e-mail: garibolo(a)wanadoo.es ---------------------------------------------------------------------------------

3 2

SuSEFirewall doesn't work?
by Markus A. Radner 11 May '04

11 May '04

Hi there! I have this weird problem with my SuSEFirewall2 on SuSE 9.0. I haven't opened any ports intentionally, but my log file says, that a lot of access attempts on highports get THROUGH the firewall. I have hundreds of entries like this in my /var/log/messages file: SuSE-FW-ACCEPT IN=eth0 OUT= MAC=00:a0:d1:d5:b4:3c:00:09:5b:a8:3e:c0:08:00 SRC=213.165.x.x DST=192.168.0.2 LEN=73 TOS=0x00 PREC=0x00 TTL=57 ID=16216 DF PROTO=TCP SPT=110 DPT=1435 WINDOW=5792 RES=0x00 ACK PSH URGP=0 OPT (0101080A0A4992810070F15B) My computer is behind a router/firewall. Someone tries to connect at port 1435 (and a lot of different other highports as well!). I disabled access to highports and I only allowed DNS and DHCLIENT as valid services. At least this was what I was thinking! Here's all the settings of my SuSEFirewall2 file. If anybody could explain waht's going on I'd really be grateful. FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="yes" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_REJECT="no" FW_HTB_TUNE_DEV="" yours, markus.

9 10

yast-re
by cybervision8＠vsnl.net 11 May '04

11 May '04

how do i upgrade/install any pakage with yast with depancy resoveing/checking on the net ,say kde 3.2 sorry last time i miss main subject thx

1 0

Re: [suse-security] SuSEFirewall doesn't work?
by Manuel Balderrábano 11 May '04

11 May '04

Hi. El Martes, 11 de Mayo de 2004 13:11, Christian Heim escribió: > Am Dienstag, 11. Mai 2004 12:58 schrieb Markus A. Radner: > > > Just one more question: Is there any command or tool that can display which > > services or programs are running on a certain port on my computer? [...] > > Markus, try netstat :) and search for your port. Much better would be to use nmap or netcat from outside of your network, that way you will see what everybody can see from the outside and that's what really matters ;-) > > -- > Mfg Christian > ------------------------------------------------ > Auszubildender im Rechenzentrum, Universität Greifswald > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > -- --------------------------------------------------------------------------------- Manuel Balderrábano e-mail: garibolo(a)wanadoo.es ---------------------------------------------------------------------------------

1 0

RE: [suse-security] Memo on Windows
by sematin＠mtn.co.ug 10 May '04

10 May '04

Take a look at: http://kirch.net/unix-nt/ Noah. > -----Original Message----- > From: A.L Paul [mailto:alikanza@amrefug.org] > Sent: 10 May 2004 09:31 > To: 'suse-security(a)suse.com' > Subject: [suse-security] Memo on Windows > > > Hi all,I need to reassure someone just how unrealiable a > windows platform can be especially if its used as a server of > any sort and is a proxy to the internet.Also,and more > importantly,I need facts and figures on the linux equivalent > so that I can put things into proper perspective for them to > wake up to reality. thanks Paul. > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

RE: [suse-security] "What manual page do you want?" message when using ssh
by Wheeler, Dr M.D. 10 May '04

10 May '04

Thank you very much, that was driving me nuts.... ---------------------------------------------- Dr. Martyn D. Wheeler Department of Chemistry University of Leicester University Road Leicester, LE1 7RH, UK. Tel (office): +44 (0)116 252 3985 Tel (lab): +44 (0)116 252 2115 Fax: +44 (0)116 252 3789 Email: martyn.wheeler(a)le.ac.uk http://www.le.ac.uk/chemistry/staff/mdw10.html -----Original Message----- From: Armin Schoech [mailto:armin.schoech@web.de] Sent: 10 May 2004 14:32 To: suse-security(a)suse.com Subject: Re: [suse-security] "What manual page do you want?" message when using ssh Hi ! > when I type ssh root@hostname from one of the nodes the following > lines are seen, > Success > What manual page do you want? > Connection to hostname closed. > > The first line is fine, however I do not understand what the second > line is about...? > --> The second line is probably caused by a misconfigured call to the "man" command. I had this problem when installing the Intel Fortran compiler IFC and executing the script /opt/intel/compiler70/ia32/bin/ifcvars.sh in the ~/.bashrc file. Change the line MANPATH="/opt/intel/compiler70/man":$(man -w); export MANPATH to MANPATH="/opt/intel/compiler70/man"; export MANPATH and it will work without the line you get above. If it's not IFC, it's probably some other start-up script that has the "man -w" command which causes the error message. HTH, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

"What manual page do you want?" message when using ssh
by Wheeler, Dr M.D. 10 May '04

10 May '04

Dear All, I have encountered some rather odd behaviour on our network. I get an odd message when is execute a remote command on the node that is connected to the outside world from one of the other nodes. On the node connected to the outside I have placed in the authorized_keys2 file the key generated on one of the other nodes on the local network. no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="echo Success" ssh-dss AA....... when I type ssh root@hostname from one of the nodes the following lines are seen, Success What manual page do you want? Connection to hostname closed. The first line is fine, however I do not understand what the second line is about...? If I do the same between nodes that are not connected to the outside i just get Success Connection to hostname closed. which is fine... Does anyone know what might be causing this behaviour? Has my security been compromised? I am running SuSE 9.0 (64 bit version) ---------------------------------------------- Dr. Martyn D. Wheeler Department of Chemistry University of Leicester University Road Leicester, LE1 7RH, UK. Tel (office): +44 (0)116 252 3985 Tel (lab): +44 (0)116 252 2115 Fax: +44 (0)116 252 3789 Email: martyn.wheeler(a)le.ac.uk http://www.le.ac.uk/chemistry/staff/mdw10.html

2 1

IPSEC/Freeswan - Symentec Internet Security 2003 - invalid ICMP Type 69
by Andreas Ernst 10 May '04

10 May '04

Hi all, i have running on Suse 9.1 Freeswan 2.04_1.5.3_45. On my W2K i installed ipsec from Marcus Mueller (vpn.ebootis.de). Everything works fine, but if i start on the W2K computer the firewall (Symentec Internet Security 2003), i get this error: invalid ICMP Type 69 Is the ICMP Tpye 69 invalid, can i change this in the config? Or is it a bug of Symentec Internet Security 2003? TIA Andreas

1 0

Memo on Windows
by A.L Paul 10 May '04

10 May '04

Hi all,I need to reassure someone just how unrealiable a windows platform can be especially if its used as a server of any sort and is a proxy to the internet.Also,and more importantly,I need facts and figures on the linux equivalent so that I can put things into proper perspective for them to wake up to reality. thanks Paul.

1 0

List still alive?
by Christian Lange 09 May '04

09 May '04

Hello out there, is the list still alive? Nothing security-related since they got the sasser/netsky-kid? Regards, Chris.

2 2

Re: [suse-security] Re: [SLE] Re: [suse-security] How do I activate TLS on sendmail?
by John Andersen 09 May '04

09 May '04

On Saturday 08 May 2004 00:59, Togan Muftuoglu wrote: > * John Andersen; <jsa(a)pen.homeip.net> on 07 May, 2004 wrote: > >I've never gotten anything but sasl to work, > >I'm going to send you some notes off-list that I compiled while > >getting this to work. There was a lot of dinking around to finally > >get it up and running because the sasl bits are not well documented > >and some authentication methods don't work (at least not for me). > > > >I was able to get this to work with Suse 8.1 and 8.2 even though one > >uses sasl and the other sasl2. > > > >I'll send my notes by separate mail. > > canyou send me a copy so I can put it on SuSEFAQ if that is fine with > you Trogan, I need to clean them up a bit first... There are many false starts in there. I'll get them to you shortly. -- _____________________________________ John Andersen

1 0

How do I activate TLS on sendmail?
by Gordon Cichon 08 May '04

08 May '04

Hi all, I'm configuring a Suse 9.1 as a mail server using sendmail. I would like to use the Suse configuration as much as possible because I would like to be able to update sendmail through Suse online update. I would like to have everybody to be able to post mail who is either * coming from localhost, or who * knows a username/passwd of a user of the machine The latter authentification should be encrypted to avoid password sniffing. The users should be able to send mail from anywhere in the internet using mozilla or outlook. Is TLS the right thing for what I want? I modified the file /etc/sysconfig/sendmail and ran SuSEconfig afterwards. I set SMTP_AUTH_* to "all" and installed almost all cyrus-sasl-* packages except the one for one-time passwords. I set STARTTLS to "both". Is this correct so far? Do I need any certificates? I did not find any instructions to generate them. If so, what is the command line to generate these certificates? (Self-certified, with correct host name, and with 10 years expiration). Am I missing anything else? Thanks a lot for your help in advance. Best Regards, Gordon.

2 3

SUSE Security Announcement: Live CD 9.1 (SuSE-SA:2004:011)
by Roman Drahtmueller 06 May '04

06 May '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: Live CD 9.1 Announcement-ID: SuSE-SA:2004:011 Date: Thursday, May 6th 2004 22:30 MEST Affected products: SUSE LINUX 9.1 Personal Edition Live CD Vulnerability Type: remote root access Severity (1-10): 8 SuSE default package: yes Other affected systems: none Content of this advisory: 1) security vulnerability resolved: Live CD 9.1 problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The freshly released SUSE LINUX 9.1 comes in two variants: * SUSE LINUX 9.1 Professional (5 CD-ROMs, 2 double sided DVDs, printed manuals, for Intel i386 32Bit platform and 1 DVD for the AMD 64Bit platform) * SUSE LINUX 9.1 Personal (2 CD-ROMs: 1 installable CD-ROM, 1 Live CD-ROM for running SUSE LINUX on your PC without actually installing the system.) This SUSE Security Announcement targets the Live CD that comes with the SUSE LINUX 9.1 Personal edition. The Live CD can boot and run on any PC that has a CD-ROM drive, offering a convenient opportunity for users who want to try out SUSE Linux without any modification to the system that is installed on the computer. Similar CD-ROM iso images have been available for download from our ftp server with each release of the SUSE LINUX home user product for years. Upon boot, the Live CD will automatically configure a network card if one has been detected. It requires user interaction for dialup network access. A configuration error on the Live CD allows for a passwordless, remote root login to the system via ssh, if the computer has booted from the Live CD and if it is connected to a network. Since the CD-ROM is a read-only medium by definition, there is no solution for this error that would be persistent over a reboot from the Live CD. Manually killing all running instances of the secure shell daemon ("killall sshd" as root) after each boot cures the problem, while still exposing the vulnerability in the time window between startup and the killing of the sshd process. It is a policy for a fresh install of SUSE LINUX products to enable the user to log on to the system using secure shell (ssh). During the installation of the system, the user is prompted for a root password. The Live CD does not install any system on a medium and therefore does not ask for a root password. By consequence, passwordless logins should be denied on the system, regardless of whether the account in question is the super user account or not. The Live CD 9.1 suffers from this misconfiguration. Our permanent fix for the vulnerability is to download the iso image of the fixed Live CD 9.1 from the URL as listed below and to burn it on a CD-R using a CD-burner and the software that comes with the SUSE LINUX 9.1 Personal or Professional (cdrecord, k3b). The new image still runs a secure shell daemon for remote login, but it does not allow remote logins on a zero-length password account, and it denies remote root login attempts, independently from the password. We thank Patrick Kranefeld and Fabian Franz who have reported the configuration neglectfulness on the SUSE LINUX 9.1 Live CD to SUSE Security. Image authenticity verification: The file LiveCD-9.1-01.iso has a length of 706349056 bytes. If you run the command "md5sum LiveCD-9.1-01.iso" after you have downloaded the file, the md5sum command should print the following md5sum: 9f4ed1bc6b3ee582bf593fde75d5db43 This md5 sum is also contained in the file MD5SUMS in the same directory as the LiveCD-9.1-01.iso file. Its signature (by security(a)suse.de) is contained in the file MD5SUMS.sig. The download location: ftp://ftp.suse.com/pub/suse/i386/live-cd-9.1/LiveCD-9.1-01.iso 9f4ed1bc6b3ee582bf593fde75d5db43 A note: Please use a mirror for downloading the SUSE LINUX 9.1 Live CD. Mirrors close to you can be found at http://www.suse.com/us/private/download/ftp/int_mirrors.html ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - canna New canna packages are available on our ftp servers, fixing tmp race conditions. - xchat A buffer overflow in the SOCKS5 code of the XChat program has been fixed. New packages are available on our ftp servers. - tcpdump The tcpdump program contained a remote DoS condition in its ISAKMP packet handling (CAN-2004-0183 and CAN-2004-0184). Fixed packages are available on our ftp servers. - lha A buffer overflow in the header parsing routines of lha has been fixed. Additionally lha did not properly handle pathnames within archives (CAN-2004-0234 and CAN-2004-0235). Fixed packages are available on our ftp servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- Roman Drahtmüller, SuSE Security. - -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQJqjyney5gA9JdPZAQFmQQf8Cb/2SHM1JrFXwYII6Kq54AH3MCLfIraf LNsStCt2PKRFOFThP5dpiez+Q8pGZMgkwTBE47Af6zo6/I2T6Y/IJguTWBv29HUf 99lh1bFj7dXjyjQ70FbhDhLp6U7PoIMI/jTbkGABw9MvLpNSCEZMyu5hn46yRT1B tvsjGJvV0IH+1neZI4rsT1H0t1aBhmH2RHN15uOBEazv6fXnQsefPqWcSAYqnMpV A/RkuMOSyJRN+DPs00uWpTmTvn77/fhPmq332D1nAU5q+XBjT/zIzLs/RFam801u H7DBWJkzVtHV7bhdNWWOQCUAll2DtUZXErwbM/EVLTmmeYGJ9boIdg== =araV -----END PGP SIGNATURE-----

1 0

RE: [suse-security] fou4s, SuSE 9.0 and recent kernel update
by GarUlbricht7＠netscape.net 04 May '04

04 May '04

Bjorn Tore Sund <bjornts(a)mi.uib.no> wrote: >On Tue, 4 May 2004 GarUlbricht7(a)netscape.net wrote: > > You misread me. I already had the patches on my own mirror > which nobody else uses. It just wasn't going from there to my clients. > > Restarting the apache server handing out the patches worked wonders, > though... :) > You are right, I misread your post. Glad you got your problem solved :) Best regards, -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

RE: [suse-security] fou4s, SuSE 9.0 and recent kernel update
by GarUlbricht7＠netscape.net 04 May '04

04 May '04

Bjorn Tore Sund wrote on 5/4/2004 4:15:43 AM Eastern Daylight Time: > > Hi people, > > I'm sufficiently confused that I have to ask for assistance. > > Tonight's kernel upgrade using fou4s went fine on SuSE 8.2 > and SLES 8. > *** Congradulations as the old song said" "Two out of three ain't bad." *** > > On SuSE 9.0 it didn't happen, > fou4s simply doesn't see the upgrade. > > Working directly towards ftp.suse.com or ftp.gwdg.de works. > Mirroring either to my local server using wget --mirror > gets me the packages and the patches/kernel-51366 file - > but trying to use fou4s towards that mirror > the 9.0-box simply fails to see that there's a kernel upgrade there. > > The mirror has worked in the past for all other patches, > including kernel patches. > > Any advice? > Yeah, try another mirror or wait. The servers are overloaded. Partly because not all the mirrors have the kernel updates yet. If you don't want to wait, what I do with fou4s is run it in interactive mode. That is: "fou4s -i --interactive" I also open up: file:/var/cache/fou4s/packages/ftp.suse.com/i386/update/8.2/rpm/i586 so I can watch the "rpm" download onto my box. I have also reconfigured fou4s so as it downloads it give me a progress bar... (see /etc/fou4s.conf) but tonite, as I said, I think everybody is trying to update their kernels the servers are just overloaded. At least that's my take. Hoe this helps, Gar -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

2 1

fou4s, SuSE 9.0 and recent kernel update
by Bjorn Tore Sund 04 May '04

04 May '04

Hi people, I'm sufficiently confused that I have to ask for assistance. Tonight's kernel upgrade using fou4s went fine on SuSE 8.2 and SLES 8. On SuSE 9.0 it didn't happen, fou4s simply doesn't see the upgrade. Working directly towards ftp.suse.com or ftp.gwdg.de works. Mirroring either to my local server using wget --mirror gets me the packages and the patches/kernel-51366 file - but trying to use fou4s towards that mirror the 9.0-box simply fails to see that there's a kernel upgrade there. The mirror has worked in the past for all other patches, including kernel patches. Any advice? Cheers, Bjørn -- Bjørn Tore Sund Phone: (+47) 555-84894 Stupidity is like a System administrator Fax: (+47) 555-89672 fractal; universal and Math. Department Mobile: (+47) 918 68075 infinitely repetitive. University of Bergen VIP: 81724 Support: system(a)mi.uib.no Contact: teknisk(a)mi.uib.no Direct: bjornts(a)mi.uib.no

1 0

SUSE Security Announcement: kernel (SuSE-SA:2004:010)
by Roman Drahtmueller 04 May '04

04 May '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: Linux Kernel Announcement-ID: SuSE-SA:2004:010 Date: Tuesday, May 5th 2004 02:30 MEST Affected products: 8.0, 8.1, 8.2, 9.0, 9.1 SuSE Linux Database Server, SuSE eMail Server III, 3.1 SuSE Linux Enterprise Server 7, 8 SuSE Linux Firewall on CD/Admin host SuSE Linux Connectivity Server SuSE Linux Office Server UnitedLinux 1.0 SuSE Linux Desktop 1.0 Vulnerability Type: privilege escalation, local DoS Severity (1-10): 7 SUSE default package: yes Cross References: CAN-2004-0427 CAN-2004-0424 CAN-2004-0229 CAN-2004-0228 CAN-2004-0394 Content of this advisory: 1) security vulnerability resolved: - do_fork() memory leak (CAN-2004-0427) - setsockopt() buffer overflow (CAN-2004-0424) - misuse of fb_copy_cmap() (CAN-2004-0229) - cpufreq_procctl() integer overflow (CAN-2004-0228) - buffer overflow in panic() (CAN-2004-0394) - wrong permissions on /proc/scsi/qla2300/HbaApiNode problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - canna - xchat - tcpdump - lha 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information Various vulnerabilities have been fixed in the newly available kernel updates. The updates consist of fixes for the following vulnerabilities: - The do_fork() memory leak, which could lead to a local DoS attack. All kernels except for SLES7 are affected. - The setsockopt() MCAST buffer overflow which allows local attackers to execute arbitrary code with root privileges. Only SLES8 based products and SL 8.1 and SL 9.0 kernels are affected by this bug. - The misuse of the fb_copy_cmap() function which could also allow local attackers to execute arbitrary code with root privileges. Only the SL 9.1 kernel is affected. - The integer overflow in the cpufreq_procctl() function. Only the SL 9.1 kernel is affected. - The wrong permissions on /proc/scsi/qla2300/HbaApiNode which allow local attackers to start DoS attacks. SLES8 kernels and SL 8.1 and 9.0 kernels are affected. - A buffer overflow in panic(). Although there seems no way to trigger this bug, it has been fixed. If you use a maintained product or SuSE Linux 8.1 or 9.0, we recommend an update. If you offer shell access to users we recommend an update in any case. SPECIAL INSTALL INSTRUCTIONS: ============================== The following paragraphs will guide you through the installation process in a step-by-step fashion. The character sequence "****" marks the beginning of a new paragraph. In some cases, you decide if the paragraph is needed for you or not. Please read through all of the steps down to the end. All of the commands that need to be executed are required to be run as the superuser (root). Each step relies on the steps before to complete successfully. Note: The update packages for the SuSE Linux Enterprise Server 7 (SLES7) are being tested at the moment and will be published as soon as possible. **** Step 1: Determine the needed kernel type Please use the following command to find the kernel type that is installed on your system: rpm -qf /boot/vmlinuz The following options are possible (disregarding the version and build number following the name, separated by the "-" character): k_deflt # default kernel, good for most systems. k_i386 # kernel for older processors and chipsets k_athlon # kernel made specifically for AMD Athlon(tm) family processors k_psmp # kernel for Pentium-I dual processor systems k_smp # kernel for SMP systems (Pentium-II and above) k_smp4G # kernel for SMP systems which supports a maximum of 4G of RAM **** Step 2: Download the package for your system Please download the kernel RPM package for your distribution with the name starting as indicated by Step 1. The list of all kernel rpm packages is appended below. Note: The kernel-source package does not contain any binary kernel in bootable form. Instead, it contains the sources that the binary kernel rpm packages are made from. It can be used by administrators who have decided to build their own kernel. Since the kernel-source.rpm is an installable (compiled) package that contains sources for the linux kernel, it is not the source RPM for the kernel RPM binary packages. The kernel RPM binary packages for the distributions can be found at these locations below ftp://ftp.suse.com/pub/suse/i386/update/. 8.0/images/ 8.1/rpm/i586 8.2/rpm/i586 9.0/rpm/i586 After downloading the kernel RPM package for your system, you should verify the authenticity of the kernel rpm package using the methods as listed in section 3) of each SUSE Security Announcement. **** Step 3: Installing your kernel rpm package Install the rpm package that you have downloaded in Steps 3 or 4 with the command rpm -Uhv --nodeps --force <K_FILE.RPM> where <K_FILE.RPM> is the name of the rpm package that you downloaded. Warning: After performing this step, your system will likely not be able to boot if the following steps have not been fully applied. If you run SUSE LINUX 8.1 and haven't applied the previous kernel update (SUSE-SA:2003:034), AND use the freeswan package, you also need to update the freeswan rpm as a dependency as offered by YOU (YaST Online Update). The package can be downloaded from ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/ **** Step 4: configuring and creating the initrd The initrd is a ramdisk that is being loaded into the memory of your system together with the kernel boot image by the bootloader. The kernel uses the content of this ramdisk to execute commands that must be run before the kernel can mount its actual root filesystem. It is usually used to initialize SCSI drivers or NIC drivers for diskless operation. The variable INITRD_MODULES in /etc/sysconfig/kernel determines which kernel modules will be loaded in the initrd before the kernel has mounted its actual root filesystem. The variable should contain your SCSI adapter (if any) or filesystem driver modules. With the installation of the new kernel, the initrd has to be re-packed with the update kernel modules. Please run the command mk_initrd as root to create a new init ramdisk (initrd) for your system. On SuSE Linux 8.1 and later, this is done automatically when the RPM is installed. **** Step 5: bootloader If you run a SUSE LINUX 8.x or a SLES8 system, there are two options: Depending on your software configuration, you have the lilo bootloader or the grub bootloader installed and initialized on your system. The grub bootloader does not require any further actions to be performed after the new kernel images have been moved in place by the rpm Update command. If you have a lilo bootloader installed and initialized, then the lilo program must be run as root. Use the command grep LOADER_TYPE /etc/sysconfig/bootloader to find out which boot loader is configured. If it is lilo, then you must run the lilo command as root. If grub is listed, then your system does not require any bootloader initialization. Warning: An improperly installed bootloader may render your system unbootable. **** Step 6: reboot If all of the steps above have been successfully applied to your system, then the new kernel including the kernel modules and the initrd should be ready to boot. The system needs to be rebooted for the changes to become active. Please make sure that all steps are complete, then reboot using the command shutdown -r now or init 6 Your system should now shut down and reboot with the new kernel. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. There is no workaround known. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, to apply the update use the command "rpm -Fhv file.rpm". Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-default-2.6.4-5… 8a5b723168ff272c728f07e731d20a99 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-smp-2.6.4-54.3.… c36d4b4314c9a9143f99f15ed77f0e76 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-bigsmp-2.6.4-54… d8937c364a9361bdf17716d2f495579f ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-syms-2.6.4-54.3… 38b3fc612e3db19f5d610cc0e8a32a6b patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-default-2.6.4-5… c92c36168cae880b2161f10a09330a48 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-smp-2.6.4-54.3.… 7e97b26abc8275b8a7bb13f2d7c8db40 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-bigsmp-2.6.4-54… 9804fe860e724c92e1bb2eeeec78ccb0 ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/kernel-syms-2.6.4-54.3… ac83a16e1f531aafe3ffe9f438ce1d78 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/kernel-source-2.6.4-54.… 065e5a4753dad819fabc6093ab8d08a2 SuSE-9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/k_deflt-2.4.21-215.i58… 257bcaaa30ab31fcb60d777f2e71fd1d ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/k_athlon-2.4.21-215.i5… 7aecd6db43bfa1d8ec2006697e3d839a ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/k_smp-2.4.21-215.i586.… 4c7bead1a476101fea816f22749b6d6e source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/kernel-source-2.4.21-21… 4ce70dbb529bd750d08b5bd4d9e4d0be SuSE-8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/k_deflt-2.4.20-111.i58… f10a9313b6c62f13b9c19e9939bd3131 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/k_athlon-2.4.20-111.i5… 521a2e74121271d5c8bf24de1f2103f0 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/k_smp-2.4.20-111.i586.… 1af79925bbe45f9f18d52cbd906120a6 ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/k_psmp-2.4.20-111.i586… dd4f1b0c2ee5562d88befd4bf49d872c source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/kernel-source-2.4.20.Su… 26b97b48cbff358c0045e3b63ce182a9 SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_deflt-2.4.21-215.i58… 61b56678254e46c7e54e8fb93ec2bee1 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_athlon-2.4.21-215.i5… 17c0a31f07d11865ac1c565987d9cd74 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_smp-2.4.21-215.i586.… e3838161492ebae56e6459770450fde0 ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_psmp-2.4.21-215.i586… 9c15362446d844474cdd5d4d376d7379 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/kernel-source-2.4.21-21… 099872db790919c4cbca6ed082d3f32b SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/images/k_deflt-2.4.18-293.i386.… 69650d40b281fbe0e9783b52f1739d64 ftp://ftp.suse.com/pub/suse/i386/update/8.0/images/k_smp-2.4.18-293.i386.rpm 4600c955d7fb9fe55b5f8dc2e8c66cd0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/images/k_psmp-2.4.18-293.i386.r… f689c0895e39ede08ca1c16bcecbdfa2 ftp://ftp.suse.com/pub/suse/i386/update/8.0/images/k_i386-2.4.18-293.i386.r… 6b418c46b6fc224f99bed1c4416284bc source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/kernel-source-2.4.18.SuSE-2… 9aafaa025c017550763d0189d2badcc6 Opteron x86_64 Platform: SuSE-9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/kernel-default-2.6… 783e77719cc89fa4c6e936ad0704b812 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/kernel-smp-2.6.4-5… 141b1be8d3fb310dfeb41e081653ab14 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/kernel-syms-2.6.4-… f6459ecda22ec7bdce955d1f838b3091 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/kernel-default-2.6… 5897174544fce8f9fbcb57744f31be4e ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/kernel-smp-2.6.4-5… 6b9118c300ecc0fffa5561bedad6dc5c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/kernel-syms-2.6.4-54.… f53b07bfebc02269952289c292c73ea4 ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/kernel-source-2.6.4-5… 8172de94d883e43d1108e11fbb330238 SuSE-9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/k_deflt-2.4.21-215… be6ffff869c95680054c45308784d387 ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/k_smp-2.4.21-215.x… f1a9c5a4696b22287553b69a5f44f0a5 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/kernel-source-2.4.21-… e932240340d4d1cc5ac3784102754a4e ______________________________________________________________________________ 2) Pending vulnerabilities in SUSE Distributions and Workarounds: - canna New canna packages are available on our ftp servers, fixing tmp race conditions. - xchat A buffer overflow in the SOCKS5 code of the XChat program has been fixed. New packages are available on our ftp servers. - tcpdump The tcpdump program contained a remote DoS condition in its ISAKMP packet handling (CAN-2004-0183 and CAN-2004-0184). Fixed packages are available on our ftp servers. - lha A buffer overflow in the header parsing routines of lha has been fixed. Additionally lha did not properly handle pathnames within archives (CAN-2004-0234 and CAN-2004-0235). Fixed packages are available on our ftp servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQJbnDney5gA9JdPZAQEMsQf/UXB5glQG7DeDNpK2KTnUCmUhMBgdi558 kF+4gjIYdJZuX7Uj7CZB8/8izRTOJcqPxPRbRHh3jZLIJh5feZAmm+JN3+UHNm/P 3lp4W2MMRRS+egVfA8/G9PFY5mF6GnWd4jHEn7tje83WlMulPIV0TL3hW+cObgJY hATy5HuWTKbEO1d39aSGIMX7EYhhPbKCD5MpxbXQJVUpPoDP5q8SW4ZUCgyTX90J pebRx6F0Yp+AP6SvVlQ/4HUKsdPeVrsnelPDx43hwHYwufbUPDMXtCf62TpjWKdL FYII7zvzvUlRpZXbznVg+pd03K2oLdsCD5EqJDbzfyuqi1bXV9mWpQ== =zYiO -----END PGP SIGNATURE-----

1 0

Restricted Samba access on 8.0
by Kenneth Schneider 03 May '04

03 May '04

I run a samba server at work using winbind and XFS/ACL's for auth and need to know which ports need to be open to only allow access to the SMB shares. I currently have 137-139 and 443 (both tcp & udp) open but always get the error "The network path was not found". Are there other ports that need to be open for access to work? Obviously if I open all ports I have access not only to the SMB shares but everything else as well. -- Ken Schneider unix user since 1989 linux user since 1994 SuSE user since 1998 (5.2)

3 3

[suse-security] Restricted Samba access on 8.0
by Armin Schoech 03 May '04

03 May '04

Hi ! > I run a samba server at work using winbind and XFS/ACL's for auth > and need to know which ports need to be open to only allow access to > the SMB shares. I currently have 137-139 and 443 (both tcp & udp) > open but always get the error "The network path was not found". Are > there other ports that need to be open for access to work? Obviously > if I open all ports I have access not only to the SMB shares but > everything else as well. > --> Port 443 is https. What you want is probably 445 ("microsoft-ds") HTH, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

SuSE 9.1 Pro and Chkrootkit
by Stefan Onken 02 May '04

02 May '04

Hello, first mentioned on a post this morning to the German SuSE ML, chkrootkit [1] is "finding" an possible infection in SuSE 9.1 Pro. Checking `lkm'... You have 8 process hidden for readdir command You have 8 process hidden for ps command Warning: Possible LKM Trojan installed a second check with RK Hunter [2] does NOT find any evidence, so it might be false alarm. Anyway: quite iritating... [1]: ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz [2]: http://downloads.rootkit.nl/rkhunter-1.0.7.tar.gz cu stonki -- www.stonki.de: the more I see, the more I know....... www.proftpd.de: Deutsche ProFTPD Dokumentation www.krename.net: Der Batch Renamer für KDE www.kbarcode.net: Die Barcode Solution für KDE

2 1

ssh and X11 help
by Calin Duma 02 May '04

02 May '04

I am reposting this question since I wasn't able to find a solution: PRODUCT: SuSE Linux (I386) 9.0 I have a problem opening an Xterm window on my Suse linux machine (SL) after I ssh (with X11 forwarding) to a remote machine (RM). The display is set correctly, I see the xterm process running on the remote machine but the xterm does not pop up on my Suse linux machine (SL). In fact I lose keyboard input capabilities in the window where I typed 'xterm' and I only get it back one the connection times out. The IMPORTANT part is that I can accomplish the same thing from a Windows machine from the same network as my SL machine via putty (win ssh client) and Exceed. That indicates that the issue is with my local SUSE setup. The last line of the verbosed ouput is identical in both cases: "confirm x11" except on the Suse machine my xterm window doesn't pop up, on the windows machine it does. This leads me to believe that tI have a Suse ssh (maybe X) related problem. I tried the newest ssh and older versions as well. I also built putty on Suse Linux and I got the same behavior One other important issue: to reach to my remote machine I ssh twice: 1. Suse Linux to remote account management machine (RAM). 2. RAM to RM ( where I finally want the xterm to run) In all cases the displays are set correctly. I also verified the xauth -list and my display is in the output and has a magic cookie. Please let me know if you have any ideas about how to solve this problem. Any suggestions will be highly appreciated. Additional info below: ** my SUSE (SL) machine suse{cduma}41: ssh -V OpenSSH_3.7.1p2, SSH protocols 1.5/2.0, OpenSSL 0.9.7b 10 Apr 2003 ** the RAM machine (after the 1st ssh from SL to RAM) gatekeeper% ssh -V OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090607f gatekeeper% echo $DISPLAY gatekeeper:14.0 ** the RM machine (where I want to do the work and start the xterm) shaman{cduma}1: echo $DISPLAY shaman:10.0 ** the RM machine ouput after I start the Xterm shaman{cduma}2: debug2: client_check_window_change: changed debug2: channel 0: request window-change debug2: client_check_window_change: changed debug1: channel request 0: window-change shaman{cduma}4: xterm debug1: client_input_channel_open: ctype x11 rchan 3 win 65536 max 16384 debug1: client_request_x11: request from <ipaddress_here> 42287 debug2: fd 7 setting O_NONBLOCK debug2: fd 7 is O_NONBLOCK debug1: channel 1: new [x11] debug1: confirm x11 debug1: client_input_channel_open: ctype x11 rchan 1 win 30000 max 1024 debug1: client_request_x11: request from <ipaddress_here> 45345 debug1: fd 7 setting TCP_NODELAY debug1: fd 7 setting O_NONBLOCK debug2: fd 7 is O_NONBLOCK debug1: channel 1: new [x11] debug1: confirm x11 ** above is where the xterm window pops uo on my Windows machine, it doesn't on my SUSE machine ** below is the logging after connection TIMEOUT debug1: channel 0: free: client-session, nchannels 2 debug3: channel 0: status: The following connections are open: #0 client-session (t4 r0 i0/0 o0/0 fd 4/5) #1 x11 (t4 r3 i0/0 o0/0 fd 7/7) debug3: channel 0: close_fds r 4 w 5 e 6 debug1: channel 1: free: x11, nchannels 1 debug3: channel 1: status: The following connections are open: #1 x11 (t4 r3 i0/0 o0/0 fd 7/7) debug3: channel 1: close_fds r 7 w 7 e -1 Read from remote host gatekeeper: Connection timed out Connection to gatekeeper closed. debug1: Transferred: stdin 0, stdout 0, stderr 118 bytes in 1327.8 seconds debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.1 debug1: Exit status -1 Thank you very much. Calin

2 1

Re: [suse-security] ssh and X11 help
by Calin Duma 01 May '04

01 May '04

Thanks Armin. I am doing it with with an ssh config file that sets the X11 forwarding via a config file entry The fact that the display is correctly set as I ssh though the two machines tells us that the X11 is forwarded - I am not sure why the xterm does not pop up. Calin Armin Schöch wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > > > > >>PRODUCT: SuSE Linux (I386) 9.0 >>I have a problem opening an Xterm window on my Suse linux machine (SL) >>after I ssh (with X11 forwarding) to a remote machine (RM). >> >>One other important issue: to reach to my remote machine I ssh twice: >> >>1. Suse Linux to remote account management machine (RAM). >>2. RAM to RM ( where I finally want the xterm to run) >> >> >> >- --> Have you tried to enable X11 forwarding explicitely with the "-X" >option? > >SL: ssh -X user@RAM >RAM: ssh -X user@RM > >I'm doing the same thing as you do and I can confirm that this setup >is working with a SuSE system. > >Good luck! >Armin > >- -- >Am Hasenberg 26 office: Institut für Atmosphärenphysik >D-18209 Bad Doberan Schloss-Straße 6 >Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY >Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 >WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: Weitere Infos: siehe http://www.gnupg.org > >iD8DBQFAk07JG8Xv4GxznLoRApvUAJ9BzXZ65sfm5cJsXfIaNT/JaUdqPACggzux >jtI6JsxdC0Iq+lNSYnKg87A= >=CprR >-----END PGP SIGNATURE----- > > > > >

3 3