October 2005 - openSUSE Security - openSUSE Mailing Lists

no-NX paper announcement
by Sebastian Krahmer 04 Oct '05

04 Oct '05

Hi, A new paper describing NX technology and its limitations can be found at http://www.suse.de/~krahmer/no-nx.pdf It contains in depth discussion and sample code for the Hammer/Linux platform, analyzes the weaknesses and discusses countermeasures. Readers and comments are welcome :-) regards, Sebastian -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

what the hell is this?
by suse-list 04 Oct '05

04 Oct '05

Help me please - what the hell in /var/log ??? logrotate crazyness :(( -rw-r--r-- 1 root root 0 Sep 7 19:30 xinetd.log-20050906 -rw-r--r-- 1 root root 0 Sep 8 19:45 xinetd.log-20050906-20050907 -rw-r--r-- 1 root root 0 Sep 9 20:00 xinetd.log-20050906-20050907-20050908 -rw-r--r-- 1 root root 0 Sep 10 20:15 xinetd.log-20050906-20050907-20050908-20050909 -rw-r--r-- 1 root root 0 Sep 11 20:30 xinetd.log-20050906-20050907-20050908-20050909-20050910 -rw-r--r-- 1 root root 0 Sep 12 20:45 xinetd.log-20050906-20050907-20050908-20050909-20050910-20050911 -rw-r--r-- 1 root root 0 Sep 13 21:00 xinetd.log-20050906-20050907-20050908-20050909-20050910-20050911-20050912

5 6

New SSH vulnerability or what? Users acted as root...
by HG 03 Oct '05

03 Oct '05

Hi! We've had a strange episode with out servers, maybe somebody has seen something similar. We first had one of those SSH attacks with invalid users. But then something that I had not seen before, but probably nothing serious. Here is some log: Sep 29 08:15:58 server sshd[20976]: Invalid user andreyd from ::ffff:194.51.214.195 Sep 29 08:15:59 server sshd[20976]: reverse mapping checking getaddrinfo for 195.192-255.214.51.194.in-addr.arpa failed - POSSIBLE BREAKIN ATTEMPT! Sep 29 08:16:00 server sshd[20978]: reverse mapping checking getaddrinfo for 195.192-255.214.51.194.in-addr.arpa failed - POSSIBLE BREAKIN ATTEMPT! But then somewhat after that (half an hour) our /var was suddenly turned to read-only. So the logs had a gap for about an hour: Sep 29 09:24:27 syrphus kernel: Additional sense: Invalid field in cdb Sep 29 09:25:01 syrphus /usr/sbin/cron[22405]: (root) CMD (/usr/local/bin/bruschedule) Sep 29 09:25:28 syrphus kernel: st0: Error with sense data: Current st0: sense key Illegal Request Sep 29 09:25:28 syrphus kernel: Additional sense: Invalid field in cdb Sep 29 10:29:15 syrphus syslogd 1.4.1: restart. Sep 29 10:29:16 syrphus SuSEfirewall2: Warning: FW_MASQ_NETS needs FW_MASQUERADE set to yes to work! Sep 29 10:29:16 syrphus nmbd[4536]: [2005/09/29 10:29:16, 0] libsmb/nmblib.c:send_udp(790) Sep 29 10:29:16 syrphus nmbd[4536]: Packet send failed to 10.0.0.255(137) ERRNO=Operation not permitted When something made the /var read-only, we of course had multiple problems. So the first question is: is there some new hole in SSH? We have SuSE 9.2 with open ssh 3.9p1-3.2 which is the newest one from YOU. And we do not have any other ports open to the server. We returned /var and some other stuff from tapes and checked that nothing really is changed. So we do not believe that anybody got in. But how else can the /var become read-only... any ideas? One of the problems that read-only /var caused is that "random" files changed to be owned by root in users home dirs. These included files like: .Xauthority, .DCOPserver_*, .ICEauthority as well as others from .kde. Fixing this was a pain... As we looked at the situation in data files more carefully, it seemed that all the files that had been modified during that time were now owned by root. We think this means that when the users logged in, the setuid didn't work correctly and the processes were left as root - i.e. the users were acting as root. Which, if is true, is kind of scary... -- HG.

4 3

openSUSE hack
by Sven 'Darkman' Michels 03 Oct '05

03 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, just read about the openSUSE hack, will someone from SuSE/Novell give some details about how that happened? (i read that some infos where avaiable but only on persian) - just would like to know how such things could happen... (hopefully someone just forgot to patch something known ;) Regards, Sven -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFDQJO1QoCguWUBzBwRAhlEAJ94TIttb5Ofrmiw9E1tO0pFnkU3/gCcC3yV hr560wq3ZhvxWURzMS6R5oY= =QdmL -----END PGP SIGNATURE-----

2 1

Re: [suse-security] does xen improve security?
by Crispin Cowan 02 Oct '05

02 Oct '05

Joe Knall wrote: > Hi all, > > imagine a ftpserver and a webserver running in two xen virtual machines > on one box; now say the ftpserver is hacked, the attacker gains root > privileges; > How much does xen protect the other vm (webserver) against the attacker? > Is it as if the webserver was running on a different physical box? > In /usr/share/doc/packages/xen the main focus seems to be flexibility > rather than security. > Anyone with experience? Running services in separate virtual machines does provide you with *some* security protection, but with 2 major limits: 1. The security of the containment provided by Xen is questionable. Xen 2.0.6 when attacked by crashme lives for only seconds http://lists.xensource.com/archives/html/xen-devel/2005-08/msg00103.html That means that if you feed "strange" sequences of instructions to a Xen virtual machines, then unpredictable things can happen. Some of those surprising things amount to a way to escape from the virtual machine, which means that it is relatively easy for attackers to find an exploit that would let them hack you. This vulnerability is *conjectured*, but there is no assurance of security either. 2. Virtual machines provide you with *isolation*, which is not very flexible. For instance if you have the FTP server on a separate VM than your web server, then you cannot use the FTP server to update the web pages. In contrast, Novell AppArmor was designed specifically for the purpose of securely confining things like your FTP and web servers. I actually presented a tutorial on exactly this topic at Novell Brainshare last week in Barcelona. Here is the official page https://www28.cplan.com/novell_91_cv/session_details.jsp?isid=274760&ilocat… and here is a copy of the talk http://crispincowan.com/~crispin/TUT304_final.sxi Crispin -- Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/ Director of Software Engineering, Novell http://novell.com

11 19

portmap only for local interfaces
by Bruno Cochofel 02 Oct '05

02 Oct '05

When I do a netstat -tlnp I find that portmap LISTEN on port 111 to all interfaces. Hist this safe? Can I change the conf so that only localhosts can connect? Bruno Cochofel

3 3

Spam and spamprevention from mailinglists
by Philippe Vogel 02 Oct '05

02 Oct '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! I always get mails a few minutes after I post to the list - By chance or intention I don't know? Are there possibilities to back-track messages delivered to clients in such cases or do I have to live with the consequences as I subscribe to a list? Is there a possibility to authorize the access to http-web-archive of this mailinglist like Redmond (TM) on MSN with this "can you read the letters in the image" so no spiders can gather information on the list? Regards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (MingW32) Comment: GnuPT 2.7.2 Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQ0AF80Ng1DRVIGjBAQLpdQb/SXvSfYjc5WsF6dk3PGziktiPS1B8jCpN 6l0V+MYEA8mnrexI/h7h+FqZPxmsClaCvW0x46FEbiKxJIR5ZUQBYtsAlycs/xQ0 hpmtMsBdWuHAxT3vnsARZRf9CIvl5wh5QEFKz7b2kKwU+OgXsZBe7cHDjozMJGsx zyX7wEd5/7N1hFsWDunaOyIHSA4RkALvIw6e3FYo1POdaRY0BSwe0sJwAPq9aAuj ICQmxG248Iu463C6XyCv0bBhB3rQPXiUZv2eCHrUAT0BuiR2XQJDIUxEFGnMkyCc ZmBRkqDpgpU= =+TpI -----END PGP SIGNATURE-----

3 2

Re: AW: [suse-security] portmap only for local interfaces
by Bruno Cochofel 02 Oct '05

02 Oct '05

I have this on my notebook and not always I use the firewall. So I was trying to know the conf just in case... ------------------------- Hello, If the Firewall closes all ports, it does not matter on wich ingterface the portmap listens, right? CU Robert Rasp

1 0

Re: [OT] Convert ogg to mp3 in 9.3 - any suggestions?
by Charles philip Chan 02 Oct '05

02 Oct '05

On 1 Oct 2005, peterb(a)vancampen.org wrote: > Is there any way to do this with what comes with SUSE 9.3? As long as you have mpg123 installed, here is a quick and dirty batch conversion script: ,----[ mp3_to_ogg.sh ] | #!/bin/sh | # | # Author: Charles Philip Chan | # | # Usage: mp3_to_ogg.sh <list of mp3 files, wild cards allowed> | # | until [ -z "$1" ]; do | echo "$1" > name.temp | mpg123 -w temp.wav "$1" | oggenc -q6 -o "`cut -d. -f1 name.temp`".ogg temp.wav | rm temp.wav | rm name.temp | shift | done `---- You can change the quality as you please. The best way to do it is to put all the mp3 you want to convert in one directory and issue the command: mp3_to_ogg.sh *.mp3 Also file renaming will only be correct when there is one period in the filename. I have to warn you though, there will be quality lost when converting lossy to lossy. Charles -- die_if_kernel("Kernel gets FloatingPenguinUnit disabled trap", regs); linux-2.2.16/arch/sparc/kernel/traps.c

1 0

Re: [OT] Convert ogg to mp3 in 9.3 - any suggestions?
by Charles philip Chan 02 Oct '05

02 Oct '05

On 1 Oct 2005, suselinux(a)cehartung.com wrote: > If it's a small number of files, Audacity with lame will do the job > nicely... one file at a time, though. However, be warned, loosy to loosy- it will sound like ass. Charles -- panic("bad_user_access_length executed (not cool, dude)"); linux-2.0.38/kernel/panic.c

1 0