February 2005 - openSUSE Security - openSUSE Mailing Lists

Spoofing of url-adreslocator
by Richard Farla 08 Feb '05

08 Feb '05

Hi, Many browser's like Netscape,Firefox,Konquerer can be spoofed at the url-adreslocator, see: http://secunia.com/multiple_browsers_idn_spoofing_test/

6 8

Security patches for Suse's 2.6 kernel
by nordi 08 Feb '05

08 Feb '05

Hi list! I've ported the hardlink/symlink protection of the grsecurity patch to Suse's 2.6 kernels. My patch makes it considerable harder (and sometimes impossible) to exploit insecure handling of files in /tmp. Additionally it prevents some other annoying things that an attacker could do with hard/symlinks. The patch, more details and install instructions can be found on my website (http://private.addcom.de/nordi/). Feedback is welcome! The patch is very small and non-intrusive. The slightly changed handling of links should(!) not break existing software. At least I've been using this patch myself on a Suse 9.1 and a 9.2 machine for a couple of weeks now and haven't seen anything break that wasn't broken before ;) Regards nordi SHA1 checksums for the patches: Suse 9.2: d8138ce3da839aefa77a236ac0bd6436318ffc52 Suse 9.1: c7210821fa8c2ca87f2a4e2cb13646bdec36f72c

2 3

My Forwarding (Fw: Bitte wenigstens weitersenden!!)
by Kai Pfeiffer 08 Feb '05

08 Feb '05

hello list, Sorry, sorry, sorry I pushed a wrong button and so this Forwarding gets to this list. I didn't want to forweard this message. Kai Pfeiffer

1 0

clamav-0.82 ? :)
by Olivier Mueller 08 Feb '05

08 Feb '05

Hello, There are the "unofficial" packages of 0.81 available on suse mirrors such as: ftp://sunsite.cnlab-switch.ch/mirror/suse/projects/clamav/ Any chances to see 0.82 there soon? :) (security update fixing MS05-002 vulnerability). Many thanks & regards, Olivier -- _______________________________________________________ Olivier Müller - PGP key ID: 0x0E84D2EA - Switzerland E-Mail: http://omx.ch/mail/ - AIM/iChat: swix3k

2 2

Re: [suse-security-announce] SUSE Security Announcement: kernel bugfixes and SP1 merge (SUSE-SA:2005:005)
by Carlos E. R. 08 Feb '05

08 Feb '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Friday 2005-02-04 at 18:01 +0100, Marcus Meissner wrote: > ______________________________________________________________________________ > > SUSE Security Announcement > > Package: kernel > Announcement-ID: SUSE-SA:2005:005 > Date: Friday, Feb 4th 2005 18:00 MET > Affected products: SUSE Linux 9.1 > SUSE Linux Enterprise Server 9 > Vulnerability Type: critical bugs > Severity (1-10): 6 > SUSE default package: yes > Cross References: > > Content of this advisory: > 1) security vulnerability resolved: > - Merged various security fixes from previous kernel update > - SUSE Linux 9.1 kernel upgraded to SLES 9 Service Pack 1 > 2) solution/workaround > 3) special instructions and notes > 4) package location and checksums > 5) pending vulnerabilities, solutions, workarounds: > - see SUSE Security Summary report. > 6) standard appendix (further information) > This kernel update by YOU (SuSE 9.1) forgets to run mk_initrd (same as previous update, as reported here), there is not cute splash border int tty1, and system crashes (blank screen at level 5, no ssh). Managed to boot into runlevel 3. /var/log/boot.msg: 198 <6>bootsplash 3.1.6-2004/03/31: looking for picture...<6>...no good signature found. <4>Console: switching to colour frame buffer device 128x48 268: <5>RAMDISK: Compressed image found at block 0 <3>RAMDISK: ran out of compressed data <3>invalid compressed format (err=1) <4>EXT2-fs warning (device hdb6): ext2_fill_super: mounting ext3 filesystem as ext2 Crashed boot log (/var/log/boot.omsg) last entries are: Starting service wdm<notice>startproc: execve (/usr/X11R6/bin/wdm) [ /usr/X11R6/bin/wdm ], [ LC_MONETARY= CONSOLE=/dev/console TERM=linux SHELL=/bin/sh LC_NUMERIC= QTDIR=/usr/lib/qt3 LC_ALL= progress=52 INIT_VERSION=sysvinit-2.85 KDEROOTHOME=/root/.kdm REDIRECT=/dev/tty1 COLUMNS=128 PATH=/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin LC_MESSAGES= vga=0x317 RUNLEVEL=5 LC_COLLATE=POSIX PWD=/ LANG=en_US.UTF-8 PREVLEVEL=N LINES=48 SHLVL=2 XCURSOR_THEME=crystalwhite no_proxy=localhost WINDOWMANAGER=/usr/X11R6/bin/kde LC_CTYPE=en_US.UTF-8 splash=verbose sscripts=59 LC_TIME= _=/sbin/startproc DAEMON=/usr/X11R6/bin/wdm ] done <notice>exit status of (xdm atd) is (0 0) <notice>start services (apache2) Starting httpd2 (prefork) <notice>startproc: execve (/usr/sbin/httpd2-prefork) [ /usr/sbin/httpd2-prefork -f /etc/apache2/httpd.conf ], [ CONSOLE=/dev/console TERM=linux SHELL=/bin/sh get_module_list_done=true progress=54 INIT_VERSION=sysvinit-2.85 REDIRECT=/dev/tty1 COLUMNS=128 get_includes_done=true PATH=/usr/local/sbin:/sbin:/bin:/usr/sbin:/usr/bin vga=0x317 RUNLEVEL=5 PWD=/ PREVLEVEL=N LINES=48 SHLVL=2 splash=verbose sscripts=59 _=/sbin/startproc DAEMON=/usr/sbin/httpd2-prefork ] Nvdia crashed; I had to revert to driver nv instead of nvidia to get into X. I tried a second time while from another PC I was looking at /var/log/warn through ssh, and these are the last lines I saw as soon as I typed init 5: Feb 7 11:55:55 nimrodel kernel: nvidia: unsupported module, tainting kernel. Feb 7 11:55:55 nimrodel kernel: nvidia: module license 'NVIDIA' taints kernel. Feb 7 11:55:55 nimrodel kernel: 0: nvidia: loading NVIDIA Linux x86 NVIDIA Kernel Module 1.0-5336 Wed Jan 14 18:29:26 PST 2004 And then also ssh crashed - but ping worked. Log files were devoid of those lines. - From the date of the nvidia module above, it was not updated - in fact, it is a year old! Where is that one coming from? Perhaps: -rw-r--r-- 1 root root 44699 2005-02-02 19:12 /lib/modules/scripts/nvidia/2.6.5-7.145-default/nv-linux.o-1.0-5336 -rw-r--r-- 1 root root 44866 2005-02-02 19:12 /lib/modules/precompiled/2.6.5-7.145-default/nvidia/gfx/nv-linux.o-1.0-5336.pre anyway, that one breaks with the new kernel update. And it came with the update. System versions: nimrodel:~ # uname -a Linux nimrodel 2.6.5-7.145-default #1 Thu Jan 27 09:19:29 UTC 2005 i686 i686 i386 GNU/Linux nimrodel:~ # cat /proc/version Linux version 2.6.5-7.145-default (geeko@buildhost) (gcc version 3.3.3 (SuSE Linux)) #1 Thu Jan 27 09:19:29 UTC 2005 nimrodel:~ # cat /etc/SuSE-release SuSE Linux 9.1 (i586) VERSION = 9.1 - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCB7xntTMYHG2NR9URAkEvAJsEyz8ULJ/u9CdJm5WfrZ1PkMkLuQCglJcL TAeExcFmGZYBqLhvC6cGrP4= =nJxZ -----END PGP SIGNATURE-----

4 5

How to replace FW_ALLOW_INCOMING_HIGHPORTS_UDP?
by Paul Elliott 08 Feb '05

08 Feb '05

Ok, I have a dialup connection to the internet. I want to let hosts on my internal net use my ISP's domain name service. For 9.1 I had: FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS domain 4000" But in 9.2 the startup process complained about this line so I commented it out in SuSEfirewall2. Now of course, attempts by hosts on my internal net to use dns fail and lines like this appear in /var/log/messages: Feb 3 23:26:49 hrnowl kernel: SFW2-FWDint-DROP-DEFLT IN=eth0 OUT=modem0 SRC=192.168.86.4 DST=199.170.88.29 LEN=56 TOS=0x10 PREC=0x00 TTL=63 ID=1 DF PROTO=UDP SPT=1034 DPT=53 LEN=36 Feb 3 23:26:49 hrnowl kernel: SFW2-FWDint-DROP-DEFLT IN=eth0 OUT=modem0 SRC=192.168.86.4 DST=199.170.88.10 LEN=56 TOS=0x10 192.168.86.4 is a host on my internal net and 199.170.88.10 and 199.170.88.29 are my ISP's dns servers! I believe the log entries are complaining about a UDP packet that was trying to go from my ISP's domain name service to my a host on my internal net. Now that FW_ALLOW_INCOMING_HIGHPORTS_UDP is not allowed, how do allow packets like this to go thru? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

3 5

iptables and syslog
by Ashley Gould 07 Feb '05

07 Feb '05

Hi list, I've setup SuSEfirewall2 on my webserver to log all connections. It is very noisy in the logs. Fine. I expected that. What I didn't expect is syslog writing kernel messages to 3 log files. All the iptables entries are triplicated in /var/log/message|warn|kernal. Much more noise than I bargained for. My 5GB /var partition is not up to it. So I reset SuSEfirewall2 to log only "critical" connections. It seems I still get just as much log activity as before (but perhaps not to all 3 logs?). My questions are, first, what does SuSEfirewall2 consider as "critical" connections? and second, how can I get syslog to write these messages into just one log file? from /etc/syslog: kern.* /var/log/kernel *.=warning;*.=err -/var/log/warn *.crit /var/log/warn *.*;mail.none;news.none -/var/log/messages from /etc/sysconfig/SuSEfirewall2: FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" -- -ashley Did you try poking at it with a stick?

2 1

Patch for wget unreleased (?)
by pelibali 06 Feb '05

06 Feb '05

Hi, About three weeks ago, on this page http://www.novell.com/linux/security/advisories/2005_01_sr.html in it's header as 'pending' there was something mentioned as "wget file overwrite problems"; which in fact was not described in details. Could you please provide more information on that; is there any fix in process, and which SUSE versions are affected? Thanks in advance, Pelibali

3 4

Fou4s 0.12.6 released
by Markus Gaugusch 06 Feb '05

06 Feb '05

Hi, I just released the latest version of Fast Online Update for SuSE (fou4s). You can get the latest version from http://fou4s.gaugusch.at/ Changelog: * Fixes for 0.12.5 + The patch description generator generates correct architecture entries now (caused packman/supplementary packages to be ignored silently) + Many bugfixes regarding x86_64 packages (for both i586 and x86_64) (thanks to Christoph Thiel!) + After a kernel update the next patch description was not shown correctly * Added config file option for "--usedir" * GPG key checking updated to support gnupg 1.4 (thanks to Matthias Andree) * SLES9 gpg key import should be fixed now * Added workaround instructions for multiple update trees with SLES9 to KNOWN_BUGS Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

SuSEfirewall2 and squid
by helge preuss 06 Feb '05

06 Feb '05

Hi everybody, I have a problem with SuSEfirewall2 in SuSE 8.2 I can't seem to get solved. I have a dialin server I want to run squid and the firewall in parallel on, so users can surf with squid as proxy and cache, and connect to the internet with my box as a simple forwarding router on all other protocols. When I disable SuSEfirewall2, squid works as intended, but, of course, no IP forwarding is done. When I start up SuSEfirewall2, I get connection timeout errors from squid, but the forwarding works as I expect. I figure that the connections to port 3128 (where I have squid listening) are forwarded somewhere else? I have a Samba server on my box as well, this is not affected but works with and without the firewall. My relevant settings in /etc/sysconfig/SuSEfirewall2 (hope I caught all relevant ones): FW_QUICKMODE="no" FW_DEV_EXT="ippp0" FW_DEV_INT="eth0 eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_SERVICES_EXT_TCP="139 3128 http ssh" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_KERNEL_SECURITY="yes" FW_REDIRECT="" # i tried "192.168.0.0/16,0/0,tcp,80,3128" as well, without success Thanks for any help Helge

3 4