June 2005 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Encrypted Filesystem
by Baenen Eric P Contr AFRL/HEC 06 Jun '05

06 Jun '05

The company I work for requires this. I have a dual boot Dell notebook - WinXP (which I virtually never use but the company requires to be on the system) and SUSE 9.2. My /home partition is an encrypted reiserfs partion - approx. 25GB. It asks me for the password/passphrase at bootup/mount. I've used this same notebook with and without the encrypted partition - I'd have to say any performance degredation is not terribly noticable. The only downside - I'd like to upgrade to SUSE 9.3 - but I'm not exactly sure how that is going to work. Eric -----Original Message----- From: Ciro Iriarte [mailto:cyruspy@gmail.com] Sent: Saturday, June 04, 2005 3:27 AM To: suse-security(a)suse.com Subject: [suse-security] Encrypted Filesystem Hi: I'll probably get a Latitude D610, and because i'll work with sensible information and because of that i was considering the encrypted filesystem option on SuSE 9.2 in case the laptop is stolen or something like that, but i'm not sure about how it works, maybe it's not practical to encrypt +/- 20GB of data and pretend to work normally with that every day, any hints? Thanks in advanced CI.- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Mozilla-release for 9.1 / 9.0...
by pelibali 06 Jun '05

06 Jun '05

Hi, After I saw today the newest MozillaFirefox release 1.0.4 appearing on a YOU server for SUSE 9.1; really hope, that the about 3 weeks ago promised mozilla-related packages will be also released for SUSE 9.1 and 9.0 (maybe last shot for 8.2?): http://www.novell.com/linux/security/advisories/2005_28_mozilla_firefox.html Would be possible to know please, that was it just seemingly skipped or let's say shifted because new vulnerabilities? Interestingly in both http://www.novell.com/linux/security/advisories/2005_12_sr.html http://www.novell.com/linux/security/advisories/2005_13_sr.html there was not a single word about that. Best regards, Pelibali

2 1

RE: [suse-security] reiserfs crash
by Barski, Dmitri 06 Jun '05

06 Jun '05

I'd try "reiserfsck /dev/hda6" first. Best be sure to have dd'ed the contents of the partition to somewhere else (tape drive is a good choice). Read the manpage of reiserfsck for options. Mit freundlichen Grüßen, Dmitri Barski Serveradministration UNIX ElectronicPartner Handel GmbH Mündelheimer Weg 40 40472 Düsseldorf Tel.: +49-211-4156-6766 Mobil: +49-172-7816303 Fax: +49-211-4156-380 E-Mail: dbarski(a)electronicpartner.de > -----Original Message----- > From: Aldrik KLEBER [mailto:aldrik.kleber@tiscali.fr] > Sent: Monday, June 06, 2005 11:08 AM > To: suse-security(a)suse.com > Subject: [suse-security] reiserfs crash > > > Hello, > a have a laptop under suse 9.1, and the home reiserfs > partition is sufferring > a crash. > > when I try to manually mount it through the the command : > mount /dev/hda6 -t reiserfs /home/ > ReiserFS: hda6: found reiserfs format "3.6" with standard journal > ReiserFS: hda6: journal params: device hda6, size 8192, > journal first block > 18, max trans len 1024, max batch 900, max commit age 30, max > trans age 30 > ReiserFS: hda6: checking transaction log (hda6) > ReiserFS: warning: is_tree_node: node level 18795 does not > match to the > expected one 3 > ReiserFS: hda6: warning: vs-5150: search_by_key: invalid > format found in block > 9933. Fsck? > ReiserFS: hda6: warning: vs-13070: > reiserfs_read_locked_inode: i/o failure > occured trying to find > ReiserFS: hda6: vs-13070: reiserfs_read_locked_inode: i/o > failure occured > trying to find stat data of [1 2 0x0 SD] > ReiserFS: hda6: using r5 hash to sort names > ReiserFS: hda6: warning: xattrs/ACLs enabled and couldn't > find/create .reiserfs_priv. Failing mount. > mount: Operation not supported > > Is there a possibility to recover the filesystem ? or to > mount in read-only to > extract the data ? > > Aldrik KLEBER > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

reiserfs crash
by Aldrik KLEBER 06 Jun '05

06 Jun '05

Hello, a have a laptop under suse 9.1, and the home reiserfs partition is sufferring a crash. when I try to manually mount it through the the command : mount /dev/hda6 -t reiserfs /home/ ReiserFS: hda6: found reiserfs format "3.6" with standard journal ReiserFS: hda6: journal params: device hda6, size 8192, journal first block 18, max trans len 1024, max batch 900, max commit age 30, max trans age 30 ReiserFS: hda6: checking transaction log (hda6) ReiserFS: warning: is_tree_node: node level 18795 does not match to the expected one 3 ReiserFS: hda6: warning: vs-5150: search_by_key: invalid format found in block 9933. Fsck? ReiserFS: hda6: warning: vs-13070: reiserfs_read_locked_inode: i/o failure occured trying to find ReiserFS: hda6: vs-13070: reiserfs_read_locked_inode: i/o failure occured trying to find stat data of [1 2 0x0 SD] ReiserFS: hda6: using r5 hash to sort names ReiserFS: hda6: warning: xattrs/ACLs enabled and couldn't find/create .reiserfs_priv. Failing mount. mount: Operation not supported Is there a possibility to recover the filesystem ? or to mount in read-only to extract the data ? Aldrik KLEBER

2 1

Newest 'chkrootkit' rpm available...
by pelibali 03 Jun '05

03 Jun '05

Hi, Based on the .spec file coming with SUSE 9.3, I prepared an rpm of the newest version of the 'chkrootkit' [ http://www.chkrootkit.org/ ] security software for SUSE 9.1. Both the binary and the source rpm packages are available: http://homepage.univie.ac.at/balazs.melikant/chkrootkit-0.45-1.peli91.i686.… http://homepage.univie.ac.at/balazs.melikant/chkrootkit-0.45-1.peli91.src.r… This release is not only a newer version, but contains various fixes in comparison to SUSE 9.3. In addition please note, that there is also a weekly cron-script included, which allows you to check your computer automatically and mails you the results. Best regards, Pelibali Ps. I would like to give credit to Patrick Shanahan, whose 'rkhunter' package gave me the idea to publish the above stuff :)

1 0

apachetop. problems with fam
by Oliver Reick 02 Jun '05

02 Jun '05

Hello all, i have installed apachetop to look at my webserver, as well the required dependencies. But when i want to start apachetop this error messages comes up: cannot connect to fam: Address already in use fam version is: fam-2.6.10-36 who starts fam (the File Alteration Monitor)? And how can i get a running apachetop? Have anyone a idea... regards

1 0

some sort of attack
by Philipp Snizek 01 Jun '05

01 Jun '05

Hi got this in my access log of an apache: 213.47.46.45 - - [18/May/2005:17:17:06 +0200] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb 1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\ xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x0 2\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 [...snipping most of it...]\x90\x90\x90" 414 348 Dr Google doesn't know anything bout it. Any ideas what sort of attack this is? Thanks Philipp

5 4

RE: [suse-security] some sort of attack
by suse＠karsites.net 01 Jun '05

01 Jun '05

Try entering the following into google: SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 I got 730 results from that! HTH - Keith Roberts http://www.karsites.net/ SPDTool - an idea for a structured open source development CASE tool. Find out more at the above link! To: suse-security(a)suse.com From: Philipp Snizek <mailinglists(a)belfin.ch> Subject: [suse-security] some sort of attack Hi got this in my access log of an apache: 213.47.46.45 - - [18/May/2005:17:17:06 +0200] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\ x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb -snip- Dr Google doesn't know anything bout it. Any ideas what sort of attack this is? Thanks Philipp

1 0

Re: [suse-security] FYI: Possible Root Privilige Escalation in 9.3 Sudo version
by Polarizer 01 Jun '05

01 Jun '05

Marcus Meissner schrieb: > On Wed, Jun 01, 2005 at 12:04:53PM +0200, Polarizer wrote: > >>Found this on bugtraq. Message is from 05/31/2005 >> >>http://www.securityfocus.com/archive/1/399427/2005-05-29/2005-06-04/0 >> >>I do not have a 9.3 box on my hands here. So please try it for yourself. >> >>security(a)suse.com became informed by author. > > > And did you see my answer? > > Sheesh. If someone can reproduce, please speak up. > > Ciao, Marcus Sorry, i did not realized the sender. BTW: When it not works on your box with a clean install it may work on another (e.g. with LDAP enabled), though. I'll run into some tests when at home. So long.

1 0

FYI: Possible Root Privilige Escalation in 9.3 Sudo version
by Polarizer 01 Jun '05

01 Jun '05

Found this on bugtraq. Message is from 05/31/2005 http://www.securityfocus.com/archive/1/399427/2005-05-29/2005-06-04/0 I do not have a 9.3 box on my hands here. So please try it for yourself. security(a)suse.com became informed by author. The Polarizer -- Polarizers at its best http://www.codixx.de/polarizer.html

2 1