June 2005 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security-announce] SUSE Security Announcement: opera various problems (SUSE-SA:2005:034)
by Frank Steiner 14 Jul '05

14 Jul '05

Hi, just like all version of 8.01 that I can download from Operas ftp server, the SuSE packages segfault on my SuSE 9.0. Other people seem to have the same problem with SuSE 9.0, look here: http://groups.google.com/groups?hl=de&lr=&threadm=20050622193542.6e210a55.l… Anyone running 8.01 successfully on SuSE 9.0? cu, Frank -- Dipl.-Inform. Frank Steiner Web: http://www.bio.ifi.lmu.de/~steiner/ Lehrstuhl f. Bioinformatik Mail: http://www.bio.ifi.lmu.de/~steiner/m/ LMU, Amalienstr. 17 Phone: +49 89 2180-4049 80333 Muenchen, Germany Fax: +49 89 2180-99-4049 * Rekursion kann man erst verstehen, wenn man Rekursion verstanden hat. *

3 4

Bug in Susefirewall FW_ALLOW_INCOMING_HIGHPORTS_UDP
by Frank Stuehmer 01 Jul '05

01 Jul '05

Hi list, just tried to use fresh installed Suse 9.3 updated with you. SuSEfirewall2-3.3-18.2 /etc/sysconfig/SuSEfirewall2 with FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" Start FW complains, four lines "iptables: No chain/target/match by that name" Reasons are in /sbin/SuSEfirewall lines 1460 and 1469: for CHAIN in $input_zones; do --> chain=input_$chain should be "CHAIN=input_$CHAIN". Frank Stuehmer

10 15

Discontinued SUSE Linux Distribution: 8.2
by Roman Drahtmueller 01 Jul '05

01 Jul '05

-----BEGIN PGP SIGNED MESSAGE----- - ------------------------------------------------------------------------- Wed Jun 29 17:00:00 MEST 2005 Dear suse-security-announce subscribers and SUSE LINUX users, With the release of the SUSE Linux 9.3 FTP edition this week, SUSE Security announces that the SUSE Linux 8.2 version of our home user product will be discontinued soon. Having provided security-relevant fixes for more than two years, vulnerabilities found in SUSE Linux 8.2 after July 14th 2005 will not be fixed any more for this product. As a consequence, the SUSE Linux 8.2 distribution directory on our ftp server ftp.suse.com has been moved from /pub/suse/i386/8.2/ to the /pub/suse/discontinued/ directory tree structure to free space on our mirror sites for the SUSE Linux 9.3 FTP edition; the 8.2 directory in the update tree /pub/suse/i386/update/8.2 will follow later in July 2005, as soon as all updates have been published. The discontinuation of SUSE Linux 8.2 enables us to focus on the SUSE LINUX distributions of a newer release date to ensure that our customers can continuously take advantage of the quality that they are used to with SUSE LINUX products. This announcement holds true for SUSE Linux 8.2 only. As usual, SUSE will continue to provide update packages for the following home users distributions: SUSE LINUX 9.0 SUSE LINUX 9.1 SUSE LINUX 9.2 and SUSE LINUX 9.3 for a two-year period after the release of the respective distribution. Please note that the maintenance cycles of SUSE LINUX Enterprise Server products and products based on the SUSE LINUX Enterprise Server operating system are not affected by this announcement. To learn more about SUSE LINUX business products, please visit http://www.novell.com/linux/suse/. If you have any questions regarding this announcement, please do not hesitate to contact SUSE Security at <security(a)suse.de>. Best regards, Roman Drahtmüller, SUSE Security. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQsK7yney5gA9JdPZAQGZ4Af/aXyoJzrkoiIe8PkysAlAbjCmbQWHnNWJ eLpk5xgtu/TTX2/zT6LrSg6t1uV4bgxg/x5026CShTXLJRpjMgRrlfZCZpSMUW3o DB5kLs2SSWWV8Ep7L2faiU5yMf4CD1LZ4HWq9wNxk/1vpbDilZL5Ni713D8r/Mcv WE5r3amyU0TkXO2peYNj4z8lk2rwiaJFUwMZzG6MRCn1CtgDXCIdwqe1gPn0tpdq r3tkRpLJrQltpPHcjO3N6MXo8OUlzThg4nm+C5WY0tbSn5eDo+DYdWH2s03fp20W M/9IKaoxACOtpgJhuljxA8OVtJ/7ybNaTfKquvfhMaoUuTiZtcBENA== =rNzC -----END PGP SIGNATURE-----

6 7

SuSEfirewall2 now on Novell Forge
by Ludwig Nussel 30 Jun '05

30 Jun '05

Hi, FYI I've put the SuSEfirewall2 subversion repository on http://forge.novell.com/modules/xfmod/project/?susefirewall2 So if you are interested in SuSEfirewall2 development feel free to try the latest and greatest. Feedback and useful patches are welcome of course. cu Ludwig -- (o_ Ludwig Nussel //\ SUSE LINUX Products GmbH, Development V_/_ http://www.suse.de/

1 0

Yast update problems ...
by Dos Wizard 30 Jun '05

30 Jun '05

Hi there, I admit that perhaps it isn't 100% the list for my issue but it's related with the update, thus the security impovement procedure. By mistake I had selected to my freshly installed 9.3 Suse Pro, to download the old OpenOffice among other things. When I realised that it's going to download the whole earlier version, I stopped that download and everything which had been fetched before open office, had been updated, ok. There after I had tried to run the update process once again, to fetch the remaining security updates, without selecting the OpenOffice again. But what ever I had tried, I can't prevent yast from resuming OpenOffice's download. It simply starts again, as something (a temp file?) had broken and needs to be deleted or edited by hand ... Any help to remove the scrap of the previous downnload for having a properly updated system would be appreciated. Nicholas BTW: My localization settings are set to Greek, I don't think it's there the problem, but I suppose I 'd have to mention it.

3 2

Re: [suse-security-announce] SUSE Security Announcement: spamassassin remote denial of service (SUSE-SA:2005:033)
by Carlos E. R. 23 Jun '05

23 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Wednesday 2005-06-22 at 17:05 +0200, Marcus Meissner wrote: > 1) Problem Description and Brief Discussion > > The anti spam tool SpamAssassin was prone to a denial-of-service > attack. A remote attacker could craft a MIME E-Mail message that > would waste a lot of CPU cycles parsing the Content-Type header. > > This is tracked by the Mitre CVE ID CAN-2005-1266. > > Only SUSE Linux 9.2 and 9.3 are affected, since they include the 3.x > version of spamassassin. Older versions are not affected. I noticed that you have upgraded to 3.0.4, and thus save me that work of manually upgrade. Thanks. But the scoring of this release (and 3.0.3 as well) is wrong: score BAYES_60 0 0 3.515 1.0 score BAYES_80 0 0 3.608 2.0 <---- score BAYES_95 0 0 3.514 3.0 score BAYES_99 0 0 4.070 3.5 Notice that the score for 80% is bigger than for 95%, for Bayes and no network tests, ie, 3.608 > 3.514 I noticed this because I manually edit bayes_99 to be 4.99 - but can I trust there is no other error in the scoring? I suggest that somebody with influence (ie, from SuSE) suggests the developers to add some automatic tests that impede this kind of congruences creeping in. - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCupMqtTMYHG2NR9URAgGyAJ0bLG0okVs/lE8iEKWYiA+b8CVnjACeJQQQ GF439GHuAV7jGcf3j+T3U0k= =xN0k -----END PGP SIGNATURE-----

2 2

imap server and security
by Cristian Del Carlo 22 Jun '05

22 Jun '05

Hi, i am planning to build a mail server for 30 users with suse linux but i don't kown what imap server to use ( cyrus - courier - dovecot - etc.. ). I read that dovecot is the better choise for security. My users must manage large mailbox ( from 100M to 1G ) but in this case i read that is cyrus the correct choise. What do you think? Best regards, Cristian Del Carlo

1 0

OpenSSL 0.9.7g for SuSE 9.1 ?
by Ralph Seichter 22 Jun '05

22 Jun '05

Hi, will OpenSSL version 0.9.7g be available as a RPM for SuSE 9.1? YOU currently holds openssl-0.9.7d-15.13, and the OpenSSL team has fixed some important bugs since then. -- Mit freundlichen Grüßen / Sincerely Dipl. Inform. Ralph Seichter

10 19

Susefirewall2 Konfiguration: Redirect Dienst auf Firewall Host ohne den Originalport freizugeben
by Jörg Spilker 18 Jun '05

18 Jun '05

Hallo, gegeben: Linux Server mit Suse 9.0 als Server für alles (Mail/News/www/ etc.) und gleichzeitig auch masq. Router. Was ich erreichen möchte: Der Dienst imap (143) soll von internen Hosts unter dieser Portnummer erreichbar sein. Aus Richtung des Internet möchte ich diesen Port aber nicht freigeben sondern einen (beliebigen) anderen Port > 1024 wählen. Unter FW_SERVICES_TCP_EXT habe ich die 143 also nicht eingetragen. Stattdessen habe ich unter FW_FORW_MASQ einen Eintrag 0/0,192.168.9.1,tcp,9143,143. Bei einem Versuch den Port 9143 zu kontaktieren bekomme ich dann im Log folgende Meldung: SuSE-FW-ILLEGAL-TARGET IN=ppp0 OUT= MAC= SRC=217.7.147.254 DST=192.168.9.1 LEN=60 TOS=0x10 PREC=0x00 TTL=58 ID=41252 DF PROTO=TCP SPT=52143 DPT=143 Funktioniert also leider nicht wie gedacht. Welchen Trick muß ich anwenden um das gewünschte zu erreichen. Mfg Jörg

5 7

how to drop ssh-attacks in SuSEfirewall2?
by Leen de Braal 17 Jun '05

17 Jun '05

Subject is the question. I have been trying to use the ipt_recent module, but if i insert rules in /etc/sysconfig/scripts/SuSEfirewall-custom it does not work. Problem is possibly the order in which rules are processed, I guess iptables does not reach my rules and has accepted traffic before hitting them. I tried putting my rules in all locations in the -custom file, to no avail. -- L. de Braal BraHa Systems NL - Terneuzen T +31 115 649333 F +31 115 649444

2 2

FYI: HyperThreading considered harmful
by Sven 'Darkman' Michels 16 Jun '05

16 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, FYI: http://www.daemonology.net/hyperthreading-considered-harmful/ any comments from SuSE about that? Regards, Sven -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFCsAD+QoCguWUBzBwRAhy0AJ9QvCKnbDttxY4v6uYOotu0oQdgbACfRwLf bmrkznCjk71buD6/NKtt1SM= =v1IB -----END PGP SIGNATURE-----

4 3

<kein Betreff>
by Dieter Giersch 15 Jun '05

15 Jun '05

______________________________________________________________ Verschicken Sie romantische, coole und witzige Bilder per SMS! Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193

1 0

limiting connections to subnets
by David Bear 15 Jun '05

15 Jun '05

I don't see anywhere in yast where I can configure the suse firewall to limit connections to a port to a subnet as well. Is this possible in the gui? So, for example, I want to limit who can ssh to a machine to 3 subnets, can I do something like port 23 host allow 129.219.0.0/32 ? -- David Bear phone: 480-965-8257 fax: 480-965-9189 College of Public Programs/ASU Wilson Hall 232 Tempe, AZ 85287-0803 "Beware the IP portfolio, everyone will be suspect of trespassing"

3 2

mmap exploit
by Philippe Vogel 14 Jun '05

14 Jun '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi! What about (CAN-2005-1265)? mmap exploit in kernel? http://www.ubuntulinux.org/support/documentation/usn/usn-137-1 Ubuntu did fix this already. Whern there will be a fix available? Reguards Philippe - -- Diese Nachricht ist digital signiert und enthält weder Siegel noch Unterschrift! Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iQD1AwUBQq3YAUNg1DRVIGjBAQKvUwb/XHMHEGvJBF34GwJx+CdCbx4/kPl1iWlc 4O3a1T91Nvcy2K9hmWKNbB7rd1TfTRqBXXu0V1Ovx2r5AUBoComUfmck9WNO111w T3P1zHBl2d+k2oFEasYc5ZwD2kJdDnY63FcYaVd00goP3nSICYjCcG9kM8ALVrMh 0Yy4iYv+BrmclkcWC0LKyvK4lDTXo1UyJFNbwmVRnID+6jaTftWqC/U0jMRKYDt6 C+Sl4yTTb0jxDpvofPMQ9Y09aqJHpv3+79yvczFIjSDcFV4LiCdSrxdj8UqrMYhv is5mabOMpZk= =+b1z -----END PGP SIGNATURE-----

3 6

Antivir licence?
by Maxim A Belushkin 14 Jun '05

14 Jun '05

Hello everyone, I'm running SuSE 9.2, and recently, I've realized antivir won't update any longer, complaining about the licence: Jun 13 10:32:25 linux antivir[7171]: Warning: the file "antivir.vdf" is more than 14 days old Jun 13 10:32:27 linux antivir[7171]: Error: new updates will not work with current license I don't recall the licence being "expirable", but was it? Could someone please shed some light on this issue for me? Thanks!

4 3

Regression in Squid Security Patch
by David J N Begley 14 Jun '05

14 Jun '05

This is a heads-up in case anyone else stumbles across this problem and (like us) ends up spending a lot of time trying to figure out what has gone wrong. The matter has been seperately reported to the SuSE Security contact address (last Friday so they may not have had a chance to investigate it yet). In short, if you're using Squid on SuSE 9.2 (others may be affected but this is the only SuSE version we've checked) with the official Squid RPMs, the latest security updates will break cache digests thus render proxy peering one-way only (that is, your proxy can fetch/use digests but cannot share its own digest with other peers). The symptom is that a seemingly perfectly good Squid config (indeed, one that was previously working) will start reporting "404 Not Found" for every cache digest request, even if the proxy has been running for days (despite the error message, the digest has been built but Squid is refusing to store it locally). Looking through some source RPMs on the 'net, the problem appears to have been introduced around release 6.8 of the Squid RPM (ie., February) and is still present in release 6.10 (April): squid-2.5.STABLE6-6.10 The culprit appears to be an old version of this security patch: squid-2.5.STABLE7-response_splitting.patch The Squid team released an earlier version (used by SuSE in the security update) that broke cache digests, then later released an updated version to correct the problem (alas, this correct version of the patch has not yet found its way into the SuSE Squid updates available via YOU). The matter can be seen discussed in this thread (note specifically the first, penultimate and last messages in this thread): http://www.squid-cache.org/mail-archive/squid-users/200501/0798.html If you compare the version of this patch in the SuSE source RPM to the version available on the Squid Web site, the newer version of the patch adds an extra line to the store digest code in order to fix the broken cache digests thus get bi-directional peering working again. Hope this saves someone some time/effort... Cheers..

1 0

e1000 Problem after Kernel Update
by Hans Ophüls (hop) 10 Jun '05

10 Jun '05

Hi, I have updated my 9.1 with a new Kernel. (2.6.5-7.111-default to 2.6.5-7.151-default). After reebot there was only one Network Interface avaliable. Setting up network interfaces: lo lo IP address: 127.0.0.1/8 doneWaiting for mandatory devices: eth-id-00:e0:81:62:29:19 eth-id-00:e0:81:62:29:1a 19 eth1 device: Intel Corp. 82801BD PRO/100 VE (LOM) Ethernet Controller (rev 82) eth1 configuration: eth-id-00:e0:81:62:29:1a eth1 IP address: 213.203.202.82/24 doneWaiting for mandatory devices: eth-id-00:e0:81:62:29:19 18 17 16 13 12 11 10 9 7 6 5 4 3 2 1 0 eth0 interface could not be set up failedSetting up service network . . . . . . . . . . . . . . . .failed In Yast both Interfaces are avaliable. But originaly eth0 was the RPO/100 Card and the Intel e1000 was eth1. So the routing table is false. Some Applications i.e. Confixx dosent also like that (because of eth0 <-> eth1 change). Can anybody help me. Can I go back to 2.6.5-7.111-default ? Please let me know if you need further Information. Thanks Hans

5 4

Daily Security Check
by Wade Grant 07 Jun '05

07 Jun '05

After installing 9.2 I noticed that it does not have the daily security check that my ver 8 systems have. I know that I cant really rely on the checks but I do like to have the email that it sends to just let me know it is still there. Was this not included in 9.2 or did I miss something during install? wade G.

2 1

Iptables help
by João Reis 07 Jun '05

07 Jun '05

Hi to all! I have the following problem. I have a gateway machine which acts as firewall (iptables) and router to the internal network. What i need is to access from outside with SSH to a internal machine, but i want some protection from the ssh dictionary attacks. I want to use the standard port 22 for ssh and perhaps use the 'recent' module for iptables in order to block this kind of attacks. I already have the block rules for iptables which i got from suse lists, as shown below: $IPTABLES -N SSH $IPTABLES -N SSH-evil $IPTABLES -A SSH-evil -m recent --name badSSH --set -j LOG --log-level DEBUG --log-prefix "evil SSH user: " $IPTABLES -A SSH-evil -j REJECT $IPTABLES -A SSH -p TCP ! --syn -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A SSH -p TCP --syn -m recent --name badSSH --rcheck --seconds 600 -j REJECT $IPTABLES -A SSH -p TCP --syn -m recent --name sshconn --rcheck --seconds 60 --hitcount 5 -j SSH-evil $IPTABLES -A SSH -p TCP --syn -m recent --name sshconn --set $IPTABLES -A SSH -p TCP --syn -j ACCEPT What i need now is to add a forward rule to an internal machine, if everything is ok. How can i do this ? Thanks to all in advance. P.S: Thanks to Rene Gallati for his iptables script. -- \|/ "Do or do not. There is no try" - Yoda \|/ |==============================================| | 2000Comp - Consultoria e Informática, Lda | | Tel: +351 22 941 99 32 | \|/ | Fax: +351 22 941 99 34 | \|/ O | www: http://www.2000comp.pt | O -|--| |--|- \| | Joao Reis | |/ / \ |==============================================| / \ ==========================================================

2 1

Encrypted Filesystem
by Ciro Iriarte 06 Jun '05

06 Jun '05

Hi: I'll probably get a Latitude D610, and because i'll work with sensible information and because of that i was considering the encrypted filesystem option on SuSE 9.2 in case the laptop is stolen or something like that, but i'm not sure about how it works, maybe it's not practical to encrypt +/- 20GB of data and pretend to work normally with that every day, any hints? Thanks in advanced CI.-

7 8

RE: [suse-security] Encrypted Filesystem
by Baenen Eric P Contr AFRL/HEC 06 Jun '05

06 Jun '05

The company I work for requires this. I have a dual boot Dell notebook - WinXP (which I virtually never use but the company requires to be on the system) and SUSE 9.2. My /home partition is an encrypted reiserfs partion - approx. 25GB. It asks me for the password/passphrase at bootup/mount. I've used this same notebook with and without the encrypted partition - I'd have to say any performance degredation is not terribly noticable. The only downside - I'd like to upgrade to SUSE 9.3 - but I'm not exactly sure how that is going to work. Eric -----Original Message----- From: Ciro Iriarte [mailto:cyruspy@gmail.com] Sent: Saturday, June 04, 2005 3:27 AM To: suse-security(a)suse.com Subject: [suse-security] Encrypted Filesystem Hi: I'll probably get a Latitude D610, and because i'll work with sensible information and because of that i was considering the encrypted filesystem option on SuSE 9.2 in case the laptop is stolen or something like that, but i'm not sure about how it works, maybe it's not practical to encrypt +/- 20GB of data and pretend to work normally with that every day, any hints? Thanks in advanced CI.- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Mozilla-release for 9.1 / 9.0...
by pelibali 06 Jun '05

06 Jun '05

Hi, After I saw today the newest MozillaFirefox release 1.0.4 appearing on a YOU server for SUSE 9.1; really hope, that the about 3 weeks ago promised mozilla-related packages will be also released for SUSE 9.1 and 9.0 (maybe last shot for 8.2?): http://www.novell.com/linux/security/advisories/2005_28_mozilla_firefox.html Would be possible to know please, that was it just seemingly skipped or let's say shifted because new vulnerabilities? Interestingly in both http://www.novell.com/linux/security/advisories/2005_12_sr.html http://www.novell.com/linux/security/advisories/2005_13_sr.html there was not a single word about that. Best regards, Pelibali

2 1

RE: [suse-security] reiserfs crash
by Barski, Dmitri 06 Jun '05

06 Jun '05

I'd try "reiserfsck /dev/hda6" first. Best be sure to have dd'ed the contents of the partition to somewhere else (tape drive is a good choice). Read the manpage of reiserfsck for options. Mit freundlichen Grüßen, Dmitri Barski Serveradministration UNIX ElectronicPartner Handel GmbH Mündelheimer Weg 40 40472 Düsseldorf Tel.: +49-211-4156-6766 Mobil: +49-172-7816303 Fax: +49-211-4156-380 E-Mail: dbarski(a)electronicpartner.de > -----Original Message----- > From: Aldrik KLEBER [mailto:aldrik.kleber@tiscali.fr] > Sent: Monday, June 06, 2005 11:08 AM > To: suse-security(a)suse.com > Subject: [suse-security] reiserfs crash > > > Hello, > a have a laptop under suse 9.1, and the home reiserfs > partition is sufferring > a crash. > > when I try to manually mount it through the the command : > mount /dev/hda6 -t reiserfs /home/ > ReiserFS: hda6: found reiserfs format "3.6" with standard journal > ReiserFS: hda6: journal params: device hda6, size 8192, > journal first block > 18, max trans len 1024, max batch 900, max commit age 30, max > trans age 30 > ReiserFS: hda6: checking transaction log (hda6) > ReiserFS: warning: is_tree_node: node level 18795 does not > match to the > expected one 3 > ReiserFS: hda6: warning: vs-5150: search_by_key: invalid > format found in block > 9933. Fsck? > ReiserFS: hda6: warning: vs-13070: > reiserfs_read_locked_inode: i/o failure > occured trying to find > ReiserFS: hda6: vs-13070: reiserfs_read_locked_inode: i/o > failure occured > trying to find stat data of [1 2 0x0 SD] > ReiserFS: hda6: using r5 hash to sort names > ReiserFS: hda6: warning: xattrs/ACLs enabled and couldn't > find/create .reiserfs_priv. Failing mount. > mount: Operation not supported > > Is there a possibility to recover the filesystem ? or to > mount in read-only to > extract the data ? > > Aldrik KLEBER > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

reiserfs crash
by Aldrik KLEBER 06 Jun '05

06 Jun '05

Hello, a have a laptop under suse 9.1, and the home reiserfs partition is sufferring a crash. when I try to manually mount it through the the command : mount /dev/hda6 -t reiserfs /home/ ReiserFS: hda6: found reiserfs format "3.6" with standard journal ReiserFS: hda6: journal params: device hda6, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30 ReiserFS: hda6: checking transaction log (hda6) ReiserFS: warning: is_tree_node: node level 18795 does not match to the expected one 3 ReiserFS: hda6: warning: vs-5150: search_by_key: invalid format found in block 9933. Fsck? ReiserFS: hda6: warning: vs-13070: reiserfs_read_locked_inode: i/o failure occured trying to find ReiserFS: hda6: vs-13070: reiserfs_read_locked_inode: i/o failure occured trying to find stat data of [1 2 0x0 SD] ReiserFS: hda6: using r5 hash to sort names ReiserFS: hda6: warning: xattrs/ACLs enabled and couldn't find/create .reiserfs_priv. Failing mount. mount: Operation not supported Is there a possibility to recover the filesystem ? or to mount in read-only to extract the data ? Aldrik KLEBER

2 1

Newest 'chkrootkit' rpm available...
by pelibali 03 Jun '05

03 Jun '05

Hi, Based on the .spec file coming with SUSE 9.3, I prepared an rpm of the newest version of the 'chkrootkit' [ http://www.chkrootkit.org/ ] security software for SUSE 9.1. Both the binary and the source rpm packages are available: http://homepage.univie.ac.at/balazs.melikant/chkrootkit-0.45-1.peli91.i686.… http://homepage.univie.ac.at/balazs.melikant/chkrootkit-0.45-1.peli91.src.r… This release is not only a newer version, but contains various fixes in comparison to SUSE 9.3. In addition please note, that there is also a weekly cron-script included, which allows you to check your computer automatically and mails you the results. Best regards, Pelibali Ps. I would like to give credit to Patrick Shanahan, whose 'rkhunter' package gave me the idea to publish the above stuff :)

1 0

apachetop. problems with fam
by Oliver Reick 02 Jun '05

02 Jun '05

Hello all, i have installed apachetop to look at my webserver, as well the required dependencies. But when i want to start apachetop this error messages comes up: cannot connect to fam: Address already in use fam version is: fam-2.6.10-36 who starts fam (the File Alteration Monitor)? And how can i get a running apachetop? Have anyone a idea... regards

1 0

some sort of attack
by Philipp Snizek 01 Jun '05

01 Jun '05

Hi got this in my access log of an apache: 213.47.46.45 - - [18/May/2005:17:17:06 +0200] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 [...snipping most of it...]\x90\x90\x90" 414 348 Dr Google doesn't know anything bout it. Any ideas what sort of attack this is? Thanks Philipp

5 4

RE: [suse-security] some sort of attack
by suse＠karsites.net 01 Jun '05

01 Jun '05

Try entering the following into google: SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 I got 730 results from that! HTH - Keith Roberts http://www.karsites.net/ SPDTool - an idea for a structured open source development CASE tool. Find out more at the above link! To: suse-security(a)suse.com From: Philipp Snizek <mailinglists(a)belfin.ch> Subject: [suse-security] some sort of attack Hi got this in my access log of an apache: 213.47.46.45 - - [18/May/2005:17:17:06 +0200] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb -snip- Dr Google doesn't know anything bout it. Any ideas what sort of attack this is? Thanks Philipp

1 0

Re: [suse-security] FYI: Possible Root Privilige Escalation in 9.3 Sudo version
by Polarizer 01 Jun '05

01 Jun '05

Marcus Meissner schrieb: > On Wed, Jun 01, 2005 at 12:04:53PM +0200, Polarizer wrote: > >>Found this on bugtraq. Message is from 05/31/2005 >> >>http://www.securityfocus.com/archive/1/399427/2005-05-29/2005-06-04/0 >> >>I do not have a 9.3 box on my hands here. So please try it for yourself. >> >>security(a)suse.com became informed by author. > > > And did you see my answer? > > Sheesh. If someone can reproduce, please speak up. > > Ciao, Marcus Sorry, i did not realized the sender. BTW: When it not works on your box with a clean install it may work on another (e.g. with LDAP enabled), though. I'll run into some tests when at home. So long.

1 0

FYI: Possible Root Privilige Escalation in 9.3 Sudo version
by Polarizer 01 Jun '05

01 Jun '05

Found this on bugtraq. Message is from 05/31/2005 http://www.securityfocus.com/archive/1/399427/2005-05-29/2005-06-04/0 I do not have a 9.3 box on my hands here. So please try it for yourself. security(a)suse.com became informed by author. The Polarizer -- Polarizers at its best http://www.codixx.de/polarizer.html

2 1

Why has IPv6 support worsend in SUSE 9.3
by Arjen Runsink 01 Jun '05

01 Jun '05

L.S. Does anyone know why IPv6 support has moved backwards in SUSE 9.3? This has made me seriously move to *BSD for my SOHO firewall/router/server box. It was almoste perfect in 9.2 but in 9.3 we are back to a level that looks like pre millenium support for IPv4!! BB, Arjen

3 3