October 2005 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security-announce] SUSE Security Summary Report SUSE-SR:2005:023
by Frank Steiner 17 Oct '05

17 Oct '05

Marcus Meissner wrote > - imap-lib crashes in client library > > The client part of the University of Washington IMAP implementation > is prone to a buffer overflow while parsing mailbox names. This > bug can probably be exploited by a remote attacker to execute > arbitrary code with the privileges of the user running the affected > mail client. (CAN-2005-2933). The 'imapd' that is included in the > "imap" package itself is not affected by this problem. > > This problem affects all SUSE Linux based products. Trying to update imap-lib-2002d-61.i586.rpm for SuSE 9.0 tells me Needs Dependency: linux-gate.so.1 I don't find any reference to "linux-gate.so" in ARCHIVES.gz for SuSE 9.0. Am I missing sth? cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

1 0

Strange server crash
by Andy 16 Oct '05

16 Oct '05

Hi to all, We have a Fujitsu Siemens server, Dual Xeon 2.8, 160GB sata HDD configured in software raid. On the server there is Apache, Php, vsftp and postgresql db running. Suse 9.1 64 Prof is installed. About once a month the server just freezes. Sometimes I can ping and it respondes, sometimes not. I cannot connect to the server anymore froma any point of view. None of the services are running anymore, http, ftp, samba etc... I cannot know if the console works because I'm not near the server. I looked over and over the log files and couldn't see anything wrong. Or maybe my log settings are not right? Any clues? Thanks in advance. Andy

8 9

Re: [suse-security] Logging what programs accesses network resources?
by Fred Williams 14 Oct '05

14 Oct '05

sorry for the repost, iptables does not log the application that made network access attempt... Hello, I know it is not quite what you asked for but, as root, if you run a netstat command like netstat -utap you can see which programs are active on which ports on which ip. In addition, if you run iptables (ie SuSEfirewall, http://www.netfilter.org/) you can configure it to log exactly what you are asking for. I'm sure someone else will have a better answer but I hope this helps. Fred >>> Odd Arne Beck <df396oab(a)beck.is-a-geek.com> 10/13/2005 5:28 PM >>> Hi! In a couple of software firewalls on Windows there can always be found a log that tells me what local program tried to access what port on what IP. Is there something that does the same, but for linux? Best regards! -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Logging what programs accesses network resources?
by Fred Williams 14 Oct '05

14 Oct '05

Hello, I know it is not quite what you asked for but, as root, if you run a netstat command like netstat -utap you can see which programs are active on which ports on which ip. In addition, if you run iptables (ie SuSEfirewall, http://www.netfilter.org/) you can configure it to log exactly what you are asking for. I'm sure someone else will have a better answer but I hope this helps. Fred >>> Odd Arne Beck <df396oab(a)beck.is-a-geek.com> 10/13/2005 5:28 PM >>> Hi! In a couple of software firewalls on Windows there can always be found a log that tells me what local program tried to access what port on what IP. Is there something that does the same, but for linux? Best regards! -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Strange server crash
by Polarizer 14 Oct '05

14 Oct '05

> What kernel to use with 9.3? Virgin from kernel.org? Same problem was discussed here a few days before. Browse the archives[1] ("Repeated kernel crash"). Roll back with the a rpm in ./lib/YaST2/you/mnt/i386/update/9.3/rpm/ or take plain vanilla from kernel-org (this is what i did). [1] http://lists.suse.com/archive/suse-security/2005-Oct/ BTW: How long is a kernel virginal? the polarizer http://www.codixx.de/polarizer.html

2 1

Logging what programs accesses network resources?
by Odd Arne Beck 13 Oct '05

13 Oct '05

Hi! In a couple of software firewalls on Windows there can always be found a log that tells me what local program tried to access what port on what IP. Is there something that does the same, but for linux? Best regards!

1 0

Re: [suse-security] Strange server crash
by Andy 13 Oct '05

13 Oct '05

I use backup scripts but none is doing such big files ~ around 300 MB. I looked over the log files in the last 3 crashes ( 12 oct, 9 sept, 1 sept) and I couldn't asociate it with any cron or script or process.... only if one of my script hangs... that is again strange, because I do only copy, database dumps... I also do rsync with another share from network. Regards, Andy. ----- Original Message ----- From: b@rry To: 'Andy' ; suse-security(a)suse.com Sent: Thursday, October 13, 2005 12:03 PM Subject: RE: [suse-security] Strange server crash check your backup processes. I had kernel panics happening to me when using tar to archive to a single file over 20G. Seems a combination of tar, gzip and reiserfs did not like the large archives and would cuase a memory condition that sent the machines into kernel panic. During kernel panic, nothing gets written to disk at all so your logs just stop dead. I found that shortly before this dead ste, I was unable to get onto the machine but it would respond, and then it would just die completely with no icmp responses even. what scripts do you run? ------------------------------------------------------------------------------ From: Andy [mailto:frum@ar-sd.net] Sent: 12 October 2005 05:57 PM To: suse-security(a)suse.com Subject: [suse-security] Strange server crash Hi to all, We have a Fujitsu Siemens server, Dual Xeon 2.8, 160GB sata HDD configured in software raid. On the server there is Apache, Php, vsftp and postgresql db running. Suse 9.1 64 Prof is installed. About once a month the server just freezes. Sometimes I can ping and it respondes, sometimes not. I cannot connect to the server anymore froma any point of view. None of the services are running anymore, http, ftp, samba etc... I cannot know if the console works because I'm not near the server. I looked over and over the log files and couldn't see anything wrong. Or maybe my log settings are not right? Any clues? Thanks in advance. Andy

3 4

RE: [suse-security] Strange server crash
by Wilde, Martin 13 Oct '05

13 Oct '05

Hi Andy, I am not sure, if I can help you - but I will though give you a hint. In former times (SuSE 8.x) we had a similar problem with one of our servers. The problem we had at this time was a (lets say hidden) error on the reiserfs. reiserfsck that was started on bootup did not detect this error - so we were to do the fsck manually (see reiserfsck(8)). As mentioned this especial error we had was with a very old version of SuSE and I would assume that this fsck behaviour is corrected in your version - but who knows :-) Martin > -----Original Message----- > From: Andy [mailto:frum@ar-sd.net] > Sent: Thursday, October 13, 2005 11:58 AM > To: b@rry; suse-security(a)suse.com > Subject: Re: [suse-security] Strange server crash > > > I use backup scripts but none is doing such big files ~ > around 300 MB. > > I looked over the log files in the last 3 crashes ( 12 oct, 9 > sept, 1 sept) and I couldn't asociate it with any cron or > script or process.... only if one of my script hangs... that > is again strange, because I do only copy, database dumps... > > I also do rsync with another share from network. > > Regards, > Andy. > > ----- Original Message ----- > From: b@rry > To: 'Andy' ; suse-security(a)suse.com > Sent: Thursday, October 13, 2005 12:03 PM > Subject: RE: [suse-security] Strange server crash > > > check your backup processes. > > I had kernel panics happening to me when using tar to > archive to a single file over 20G. > > Seems a combination of tar, gzip and reiserfs did not like > the large archives and would cuase a memory condition that > sent the machines into kernel panic. > > During kernel panic, nothing gets written to disk at all so > your logs just stop dead. > > I found that shortly before this dead ste, I was unable to > get onto the machine but it would respond, and then it would > just die completely with no icmp responses even. > > what scripts do you run? > > > > -------------------------------------------------------------- > ---------------- > From: Andy [mailto:frum@ar-sd.net] > Sent: 12 October 2005 05:57 PM > To: suse-security(a)suse.com > Subject: [suse-security] Strange server crash > > > Hi to all, > > We have a Fujitsu Siemens server, Dual Xeon 2.8, 160GB sata > HDD configured in software raid. On the server there is > Apache, Php, vsftp and postgresql db running. Suse 9.1 64 > Prof is installed. > > About once a month the server just freezes. Sometimes I can > ping and it respondes, sometimes not. I cannot connect to the > server anymore froma any point of view. None of the services > are running anymore, http, ftp, samba etc... I cannot know if > the console works because I'm not near the server. I looked > over and over the log files and couldn't see anything wrong. > Or maybe my log settings are not right? > > Any clues? > > Thanks in advance. > > Andy >

1 0

samba weirdness
by suse-list 12 Oct '05

12 Oct '05

SuSE 9.3, all YOU updates. # rpm -q samba samba-3.0.13-1.1 #testparm ......... [in] comment = File Exchange. path = /storage/ force user = samba_quota read only = No create mask = 0644 guest ok = Yes ......... /storage is reiserfs 3.6 when i create file: #ls /storage -rw-r--r-- 1 root root 137 Nov 22 2004 readme.txt i thought that users coming to \\srv\in only can read file readme, but they can /DELETE/ this file !!! Help!

4 3

chmod +i
by suse-list 11 Oct '05

11 Oct '05

in ext3 the immutable bit exists. is there any way to do smth like this with reiserfs? we want a dir owned by foo, and a file in it, owned by root, and we dont want to foo delete a root-file ...

1 0