August 2004 - openSUSE Security - openSUSE Mailing Lists

Whining... (Was Bad Quali....)
by b＠rry.co.za 29 Aug '04

29 Aug '04

The thing I don't get. The majority of people on this list have installed free software (I would love to see the amount of SuSE systems out there as a percentage of the amount SOLD by SuSE). While this is in the Open Source community no excuse for bad quality control, the overall service received from SuSE in unofficial support over the past 5 years has been nothing short of brilliant. A mistake has happened, been recognised, and guaranteed will be analysed to try and prevent the same mistake from happening again. Most kids fall off their bucycle at some point. They learn at that point that turning in the sand at high speed is a bad idea and don't do it again (unless the truck they are trying to avoid takes their eyes off the road for a moment). So all in all, SuSE keep it up, everyone else, shut up, I am getting to see this thread as SPAM in my security mailbox and am sure that while I am only adding to the problem now, hopefully you will all grow up and spend more time fixing your problems than whining because someone else isn't. -- Q: How many lawyers does it take to change a light bulb? A: You won't find a lawyer who can change a light bulb. Now, if you're looking for a lawyer to screw a light bulb...

8 12

Insecure temp file creation fix - peer review please
by Derek Fountain 29 Aug '04

29 Aug '04

A few days back I noticed that the /usr/bin/asciiview script from the aalib-1.4.0-275 package in SUSE-9.1 used insecure temp file creation. The exploit is trivial and allows an attacker to cause a victim to overwrite any of the victim's files. The project over at Sourceforge (http://aa-project.sourceforge.net) appears to be dead, having had no update for 3 years. Emails to the two maintainers (at least the email addresses found in the SUSE RPM information) came bouncing back. So I thought I'd fix the bug myself... :) Since the script is small, I can post it here - see below. Perhaps someone with a bit more experience at this sort of thing can have a look at it to see if I've done it properly? If my fix checks out I'll post it on the Sourceforge project page, although whether anything good will actually become of it is anyone's guess... #!/bin/bash # asciiview - an ascii art image browser script. Front end for aview/aaflip TDIR=${TMPDIR:-/tmp}/aview_$$ FIFO=$TDIR/aview$$.pgm clear() { kill $! 2>/dev/null rm -f $FIFO 2>/dev/null rmdir $TDIR 2>/dev/null } myconvert() { if anytopnm $1 >$FIFO 2>/dev/null ; then exit elif convert -colorspace gray $1 pgm:- 2>/dev/null ; then exit fi echo "Failed to convert file format to PNM by both convert and anytopnm" >&2 while true; do echo "0 " done } filenames="" options="" if [ "$1" = "" ]; then echo "$0 - an ascii art image/animation browser. To run this script you need aview, aaflip and NetPBM or ImageMagick. You may browse any graphics format supported by NetPBM or ImageMagick and .fli/.flc files. Usage: $0 [options] [filenames] type aview --help [enter] for list of options. " exit 1 fi while [ "$1" != "" ]; do case $1 in "-font" | "-driver" | "-kbddriver" | "-mousedriver" | "-*width" | "-*height" | "-bright" | "-contrast" | "-gamma" | "-random" | "-dimmul" | "-boldmul") options="$options $1 $2" shift shift ;; -*) options="$options $1" shift ;; *) filenames="$filenames $1" shift ;; esac done trap clear 0 (umask 077 && mkdir $TDIR) || { echo "Unable to create temp directory $TDIR" exit 1 } mkfifo $FIFO || { echo "Unable to create FIFO $FIFO" exit 1 } for name in $filenames ; do if test -r $name ; then case $name in *.fli | *.lfc | *.flic ) PATH="$PATH:." aaflip $options $name ;; *) myconvert $name >$FIFO & pid=$! PATH="$PATH:." aview $options $FIFO kill $pid 2>/dev/null esac else echo "$name could not be opened" fi done

3 2

Something broken in wvdial
by Carlos E. R. 29 Aug '04

29 Aug '04

Hi, Las mont I reported in SLE that I was getting the string "ovider" printed by the wvdial program when run on a terminal: --> Using interface ppp0 --> pppd: ovider --> pppd: ovider --> pppd: ovider --> Authentication (CHAP) started Then, after some kernel update, it changed to "Provider". Today, after I added a comment to /etc/wvdial.conf, it has changed to: --> pppd: Inherits --> pppd: Inherits Which is also a string contained in the wvdial.conf file, and I suppose, in the token space of the wvdial program. On a spanish Knoppix 3.4 live CD, the message is "espera", that is, "wait". That seems a quite more reasonable message. There is some weird string management there, an out of bounds or a not initialised pointer perhaps. Seems dangerous to me... the type of error that leads to a memory overflow and user user scalation or whatever it is called. That would be a security problem. Not to mention the speed limit of 2 Kb/s... but that is perhaps an unrelated problem. I forgot, this is SuSE 9.1. -- Cheers, Carlos Robinson

1 0

e-mail account does not exist
by Philippe Vogel 29 Aug '04

29 Aug '04

Hi! Can anyone remove following mail from the suse-security-list? suse-security(a)nl.corp.keenondots.net I got this several times: [...] suse-security on Sun, 29 Aug 2004 01:55:00 +0200 The e-mail account does not exist at the organization this message was sent to. Check the e-mail address, or contact the recipient directly to find out the correct address. <dc0.nl.corp.keenondots.net #5.1.1> [...] Subject: Re: AW: [suse-security] Very Slow Network-I need some help! From: "Philippe Vogel" <filiaap(a)freenet.de> Date: Sun, 29 Aug 2004 01:55:00 +0200 To: "suse-security" <suse-security(a)nl.corp.keenondots.net> content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_002_01C48D5A.6D16CB80" Message-ID: <5AD18AFA6BE20444903B38DC8907F6290A1841(a)dc0.nl.corp.keenondots.net> X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Thread-Topic: AW: [suse-security] Very Slow Network-I need some help! Thread-Index: AcSNWm3MrowclVL9QOiCJq2AX1lARw== List-Help: <mailto:suse-security-help@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe-subscriptions=keenondots.com@suse.com> [...]

1 0

AW: [suse-security] Very Slow Network-I need some help!
by Rasp, Robert 28 Aug '04

28 Aug '04

Hello, How can squid run without a writeable file system ? Is there a hard drive in the firewall witch only is used by squid ? Slow Networks can be based on false DNS-Configurations CU Robert -----Ursprüngliche Nachricht----- Von: Paul Ikanza [mailto:PIkanza@newvision.co.ug] Gesendet: Freitag, 27. August 2004 13:45 An: suse-security(a)suse.com Betreff: [suse-security] Very Slow Network-I need some help! Hi Everyone, im running suse firewall on CD for my squid. It works in such a way that when the server boots, it actually boots from the cd-rom drive and picks some files from a floppy diskette (Which can be edited to suit one's need). It is therefore really secure in that a hacker would not write onto the CD-they can only go as far as maybe viewing the contents. I am however experiencing really slow network speeds as in really slow! I need ideas on how I can possibly troubleshoot that problem and if any one is actually using this procedure for a firewall, bring me upto speeed on it. Paul. o ~ o ~ o ~ o ~ o ~ o ~ o ~ o ~ o ~ o ~ o Julius Paul Ikanza Systems Administrator New Vision Printing & Publishing Company email: pikanza(a)newvision.co.ug -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Very Slow Network-I need some help!
by Paul Ikanza 27 Aug '04

27 Aug '04

Hi Everyone, im running suse firewall on CD for my squid. It works in such a way that when the server boots, it actually boots from the cd-rom drive and picks some files from a floppy diskette (Which can be edited to suit one's need). It is therefore really secure in that a hacker would not write onto the CD-they can only go as far as maybe viewing the contents. I am however experiencing really slow network speeds as in really slow! I need ideas on how I can possibly troubleshoot that problem and if any one is actually using this procedure for a firewall, bring me upto speeed on it. Paul. o ~ o ~ o ~ o ~ o ~ o ~ o ~ o ~ o ~ o ~ o Julius Paul Ikanza Systems Administrator New Vision Printing & Publishing Company email: pikanza(a)newvision.co.ug

3 2

RE: [suse-security] Problem with SuSEfirewall2 on SuSE 9.0
by Laat-de, Geert-Jan 27 Aug '04

27 Aug '04

Ludwig, Thank you very much for your help, that solution worked like hell. Best regards, Geert-Jan > -----Original Message----- > From: Ludwig Nussel [mailto:ludwig.nussel@suse.de] > Sent: woensdag 25 augustus 2004 17:01 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Problem with SuSEfirewall2 on SuSE 9.0 > > > Laat-de, Geert-Jan wrote: > > I've got a question with respect to SuSEfirewall2 on SuSE > 9.0. I'm upgrading > > my system coming from SuSE 6.3, on which I used the > SuSEfirewall package. > > Within the FW_MASQ_NETS I used to enter individual IP > addresses of local > > machines, e.g. FW_MASQ_NETS="192.168.0.13 192.168.0.15". > > > > When I use the same FW_MASQ_NETS in SuSEfirewall2 I get an > error message > > "Integer expression expected.". Is it at all possible to > use individual IP > > addresses ? And if so, How ? > > The error message is a bug. Just append /32 to each IP to make it > work. > > > This e-mail is for the intended recipient only. > > If you have received it by mistake please let us know by > reply and then > > delete it from your system; access, disclosure, copying, > distribution or > > reliance on any of it by anyone else is prohibited. > > If you as intended recipient have received this e-mail > incorrectly, please > > notify the sender (via e-mail) immediately. > > use gpg. > > cu > Ludwig > > -- > (o_ Ludwig Nussel > //\ SUSE LINUX AG, Development > V_/_ http://www.suse.de/ > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > This e-mail is for the intended recipient only. If you have received it by mistake please let us know by reply and then delete it from your system; access, disclosure, copying, distribution or reliance on any of it by anyone else is prohibited. If you as intended recipient have received this e-mail incorrectly, please notify the sender (via e-mail) immediately.

1 0

Old worm
by b＠rry.co.za 26 Aug '04

26 Aug '04

One of my servers is picking up huge volumes of requests for http://www.instituto.com.br/attackDoS.php?ver=01&task=newzad&first=1 This is a worm infection that somehow eluded the various anti virus solutions these people are running. It is hammering my squid proxy, even though the current zone for the domain points www.instituto.com.br to 127.0.0.1 I have created an explicit deny for the url, but the cache still has to deny the requests, so huge load on the cpu right now. The customers sysadmin is away and I cannot get there until probably tuesday (usually I only support the Linux servers), is there a way to block this with a reduced load so that the rest of my system can operate normally? P.S. I have no idea where this came from as the users are not permitted to download executables, scripts etc, and we have a comercial antivirus product that has successfully updated its pattern file every hour for the last 8 months. This also plugs into squid, so denying mime types via squid reduces the load but the anti-virus still checks things that go through (including activex and other scripts) -- After your lover has gone you will still have PEANUT BUTTER!

2 1

Re: [suse-security] Whining... (Was Bad Quali....)
by Michael Sim 26 Aug '04

26 Aug '04

Dear Barry, One cannot agree with you more, forcing staff to use gross language in order to please iTGeeks is beyond my comprehension. Mistakes are the ransom of success, on top of which I doubt very much that OpenSource soft if I'm not mistaken, as opposed to proprietary soft, has the same development budgets as BGs of this world have to throw at their softs. Give these guys a break & don't let them resort to gross language to satisfy iTGeeks' ego, it's bad for the corporate image. Regards Michael Sim SLI - MIS Central Team Phone: (32 0) 16 800 369 Fax: (32 0) 16 800 398 The information contained in this email is private and is solely for the use of the intended recipient(s). If you are not the intended recipient you have no entitlement to use the contents of this email. Views expressed in this email do not necessarily reflect SLi policies, does not guarantee that any attachments are free from viruses or other defects and accepts no liability for any losses resulting from infected email transmissions. Further information on SLi, services and products can be found at www.sylvania-lighting.com -----"b(a)rry.co.za" <b(a)rry.co.za> wrote: ----- To: suse-security(a)suse.com From: "b(a)rry.co.za" <b(a)rry.co.za> Date: 26/08/2004 11:59 Subject: [suse-security] Whining... (Was Bad Quali....) The thing I don't get. The majority of people on this list have installed free software (I would love to see the amount of SuSE systems out there as a percentage of the amount SOLD by SuSE). While this is in the Open Source community no excuse for bad quality control, the overall service received from SuSE in unofficial support over the past 5 years has been nothing short of brilliant. A mistake has happened, been recognised, and guaranteed will be analysed to try and prevent the same mistake from happening again. Most kids fall off their bucycle at some point. They learn at that point that turning in the sand at high speed is a bad idea and don't do it again (unless the truck they are trying to avoid takes their eyes off the road for a moment). So all in all, SuSE keep it up, everyone else, shut up, I am getting to see this thread as SPAM in my security mailbox and am sure that while I am only adding to the problem now, hopefully you will all grow up and spend more time fixing your problems than whining because someone else isn't. -- Q: How many lawyers does it take to change a light bulb? A: You won't find a lawyer who can change a light bulb. Now, if you're looking for a lawyer to screw a light bulb... -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Bad quality of updates from SuSE ftp server
by Hubertus Haniel 26 Aug '04

26 Aug '04

On the FTP server is a mkinitrd-1.0-219.i586.rpm which actually contains mkinitrd-1.0-221 so to fix the nice graphical boot screen which was broken with mkinitrd-1.0-219 one has to remove the currently installed mkinitrd-1.0-219 and install it again from the FTP server to perform the update. Yesterday Yast tried to do the right thing as instructed by patches/mkinitrd-51598 but failed as it was looking for mkinitrd-1.0-221.i586.rpm which did not exist. Today this patch was marked as obsolete. The spamassassin update published today for 8.2 contains only spamassassin but no update for perl-spamassassin so I had to rebuild the source rpm to get both. I don't know about everybody else but I personally find the standard of SuSE updates has dropped since Novell have got the fingers in the pie. Best regards Hubba

18 31