openSUSE Security April 2006

security@lists.opensuse.org

43 participants
20 discussions

RE: [suse-security] unsubscribe to the mailling list
by Phil Betts 11 Apr '06

11 Apr '06

Roman Drahtmueller wrote on Tuesday, April 11, 2006 12:52 AM:: >> hi: >> >> I like to unsubscrib the the suse mailing list. How can I do it ? >> > > You look at the footers of all the mails and find out. > I cringe whenever I see this type of query (particularly when the message itself is distributed with the requested information), however the very next thread did NOT contain the info. Any idea why? Looking back through my archive, this happens quite a lot. Many of the messages without the info appended were PGP signed, or had other attachments, but there are others that just seem to slip through unmolested. Is there an X-Teflon header? If so, (obviously not called that!) it could prove useful for avoiding the sort of pseudo-legal rubbish that my employer appends to my mail. Phil -- Anything below this is gibberish, anything above may be also. ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the H.E Information Systems Ltd. Tel: 0161 866 9066 Web: www.heis.co.uk This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.clearswift.com **********************************************************************

1 0

Patch information retrieval failed
by Miguel ALBUQUERQUE 11 Apr '06

11 Apr '06

Hello guys, I got this error when manually updating a system : ERROR(You:Error parsing patch description.) Error parsing 'Deltas' attribute. Line ' xorg-x11-server-6.8.2-100_100.4.i586.delta.rpm 245406 3ad5216c49cc61665280daa091d520e8 xorg-x11-server-6.8.2-100 1126567701 3e051563544c6ffdf167c19a999566c4' doesn't have form 'filename size md5sum name-edition-release buildtime srcmd5sum seq'. Is that me or the patch description is corrupted ? Many thanks Miguel Albuquerque Network Administrator CODaLIS SA Chemin de Trèfle-Blanc 18 1228 Plan-Les-Ouates / CH TEL : +41 22 827 30 80 FAX : +41 22 827 30 33 http://www.codalis.ch DISCLAIMER - This message is intended for the use of the named person only. The information contained in this E-mail is confidential and any disclosure, copying, distribution or taking any action in reliance on the contents of this information is strictly prohibited. This message does not represent a formal commitment by Codalis SA. Codalis SA is neither liable for the proper and complete transmission of the information contained in this communication nor for any delay in its receipt.

2 1

Unverifiable GPG Signatures
by Bernie Hoefer 10 Apr '06

10 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The Java2 and Java2-JRE 1.4.2-129.23 packages that were uploaded to the SuSE FTP site on March 28th don't have the same version of GPG signatures as previous Java2 packages. Thus, they cannot be verified. (Or at least I do not know how to verify them.) For example, on one of the packages that was released 2005-12-20: === > $ rpm --checksig ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.19.i58… > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.19.i58…: sha1 md5 gpg OK === I can verify the GPG signature. But on one of the packages that was released 2006-03-28: === > $ rpm --checksig ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.23.i58… > only V3 or V4 signatures can be verified, skipping V0 signature > ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/java2-1.4.2-129.23.i58…: sha1 md5 OK === - -- Bernie Hoefer PGP e-mail is welcome! Get my 1024 bit signature key from: <http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0x446A6F93>. "The more I know, the more I realize how much I do not understand." -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFENpJbckGmqURqb5MRAlVaAJ4le5jc5HWhXWxkHKBQAz3iMxizOACeK2ra yGkOg+nUFCTQLrgqe7kCILE= =bnjS -----END PGP SIGNATURE-----

5 5

SPAM:
by Bojahra, Uwe 05 Apr '06

05 Apr '06

1 0

Problem with "kaffeine-52821"
by Armin Schoech 05 Apr '06

05 Apr '06

Hi, there is an error in the patch file "kaffeine-52821" from "March 30 09:00" in the name of the delta package. WRONG: Deltas: kaffeine-0.5-10_10.2.i586.hurwitz_suse_de_1111592786.delta.rpm 47211 71e98b6b08e2f48c50ea2cca57bda6f3 kaffeine-0.5-10 1111592786 a49a94349af970d37250937fc1efbe6c kaffeine-0.5-10-58da41c73c1a0f4300d0c703475623edf920 RIGHT: Deltas: kaffeine-0.5-10_10.2.i586.delta.rpm 47211 71e98b6b08e2f48c50ea2cca57bda6f3 kaffeine-0.5-10 1111592786 a49a94349af970d37250937fc1efbe6c kaffeine-0.5-10-58da41c73c1a0f4300d0c703475623edf920 Could someone from SuSE please clean up this patch file. This would be great. Or is this a problem of "fou4s" only and YOU figures out the correct filename ? Thanks for your help! Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

2 1

sendmail update for suse 9.0 ?
by iS-Fun Internet Services GmbH, Holger Diehm 04 Apr '06

04 Apr '06

Hi anyone in the list, I wonder if anyone knows a repository that still makes updates for suse 9.0 or even earlier available? For other distros there are som "addicts" that share their update-efforts with others für no longer officially supported Versions. Due to the severity of the latest sendmail race-condition problem I'd like to update my older mail servers but i really want to avoid a complete distrie-update just for sendmail. Has anyone a clue für such non-vendor-update-sites? Or does a person at novell/suse perhaps still provide some packages on some site ? Or would a package for SLES8 match with glibc of suse 9.0 (I tried the ackages of 9.1 but they don't fit)? any help is welcome. Thanks, Holger

15 31

[Fwd: Re: [suse-security] sendmail update for suse 9.0 ?]
by Chuck Linsley 04 Apr '06

04 Apr '06

Rainer Duffner wrote: > Crispin Cowan wrote: >> miguel gmail wrote: >> >>>> Therefore it is basically not possible for SUSE to distribute Qmail. >>>> At >>>> most we could bundle the source code and give you instructions on how >>>> to >>>> compile it. >>>> >>>> >>> Oh! That would be more than wellcome for newcommers to mail servers >>> administrators... :-) # ./configure; make; make install worked for me. :-) Of course, configuration is another matter. > creates less headaches) - but what I really miss are RPMs (or > .spec-files) for djbdns (and daemontools and ucspi-tcp). > DJB's DNS-cache is one of those things that I end up installing on all > hosts that need to do more than a handful of lookups - and it can boost > performance several orders of magnitude compared to using a non-local > DNS-resolver. I installed daemontools, but not (yet) djbdns nor ucspi-tcp. But my server will typically not need to do more than a handful of lookups. Actually, at least for now, most/all of my outgoing mail is routed through my ISP's SMPT server. I am using qmail mostly for incoming mail. > So, as binaries are not allowed for all DJB-ware and the default install > is really horrible, I'd appreciate if some kind of "clean" .spec file, > that helps installing it in a SuSE-compliant way, was available. > Because it does offer significant value ;-) What is horrible about the default install? You and others mention that it needs a lot of patching to give it basic functionality? I used the default install, and it *seems* to be working for me. However, I am not stressing it much (and probably never will; it will be the server for my family and my wife's small business -- perhaps a few dozen outbound messages a day, a once-a-month mass mailing to a list of 100 or so subscribers, and maybe a hundred or so incoming messages a day). I have not figured out how to hook it up to SpamAssasin, but I have not put much effort in to it yet -- almost nobody knows about the addresses handled by my server, so it is not getting spammed (yet). I'm concerned about security issues in the default install. I'm less concerned about performance issues, since it is not going to be processing much mail. -- Chuck Linsley linsley(a)sonic.net

1 1

ezmlm warning
by suse＠karsites.net 04 Apr '06

04 Apr '06

Are other people on the list getting these warnings from ezmlm, or is it just me? Or is someone spamming the list? Regards Keith ---------- Forwarded message ---------- Return-Path: <suse-security-return-warn-1144005131.nlibmageogeagcdobghp-suse=karsites.net @suse.com> X-Original-To: keith@localhost Delivered-To: keith(a)localhost.karsites.net Received: from localhost (localhost [127.0.0.1]) by karsites.net (Postfix) with ESMTP id 0C5D8E55B8 for <keith@localhost>; Sun, 2 Apr 2006 20:06:28 +0100 (BST) X-Original-To: karsites(a)kar.eclipse.co.uk Delivered-To: karsites(a)kar.eclipse.co.uk Received: from mail.eclipse.co.uk [82.153.251.6] by localhost with IMAP (fetchmail-6.2.5) for keith@localhost (single-drop); Sun, 02 Apr 2006 20:06:29 +0100 (BST) Received: from MXA05.ch.as12513.net (mxa05.ch.as12513.net [82.153.252.56]) by mda03.ch.as12513.net (Postfix) with ESMTP id 1A8D6F3A24 for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:21 +0100 (BST) Received: from localhost (localhost [127.0.0.1]) by MXA05.ch.as12513.net (Postfix) with ESMTP id F375EC046B for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:21 +0100 (BST) Received: from MXA05.ch.as12513.net ([127.0.0.1]) by localhost (MXA05.ch.as12513.net [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 05716-01-93 for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:20 +0100 (BST) Received: from fwd01.ch.as12513.net (fwd01.ch.as12513.net [82.153.252.42]) by MXA05.ch.as12513.net (Postfix) with ESMTP id E4A99C011A for <karsites(a)kar.eclipse.co.uk>; Sun, 2 Apr 2006 20:12:20 +0100 (BST) Received: from mxa04.ch.as12513.net (mxa04.ch.as12513.net [82.153.252.45]) by fwd01.ch.as12513.net (Postfix) with ESMTP id A0C94F3A1D for <suse(a)karsites.net>; Sun, 2 Apr 2006 20:12:19 +0100 (BST) Received: from lists.suse.com (lists.suse.de [195.135.221.131]) by mxa04.ch.as12513.net (Postfix) with SMTP id 7E255C043E for <suse(a)karsites.net>; Sun, 2 Apr 2006 20:12:20 +0100 (BST) Received: (qmail 12207 invoked by alias); 2 Apr 2006 19:12:15 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Date: 2 Apr 2006 19:12:15 -0000 Message-ID: <1144005135.12148.ezmlm-warn(a)suse.com> From: suse-security-help(a)suse.com To: suse(a)karsites.net Content-type: text/plain; charset=us-ascii Subject: ezmlm warning X-Virus-Scanned: by Eclipse VIRUSshield at eclipse.net.uk X-Spam-Status: No, hits=0.124 tagged_above=0.1 required=0.3 tests=NO_REAL_NAME X-Spam-Level: Hi! This is the ezmlm program. I'm managing the suse-security(a)suse.com mailing list. I'm working for my owner, who can be reached at suse-security-owner(a)suse.com. Messages to you from the suse-security mailing list seem to have been bouncing. I've attached a copy of the first bounce message I received. If this message bounces too, I will send you a probe. If the probe bounces, I will remove your address from the suse-security mailing list, without further notice. I've kept a list of which messages from the suse-security mailing list have bounced from your address. Copies of these messages may be in the archive. To retrieve a set of messages 123-145 (a maximum of 100 per request), send an empty message to: <suse-security-get.123_145(a)suse.com> To receive a subject and author list for the last 100 or so messages, send an empty message to: <suse-security-index(a)suse.com> Here are the message numbers: 26706 --- Enclosed is a copy of the bounce message I received. Return-Path: <> Received: (qmail 19586 invoked from network); 22 Mar 2006 03:57:26 -0000 Received: from unknown (HELO Relay1.suse.de) (195.135.221.8) by 0 with SMTP; 22 Mar 2006 03:57:26 -0000 Received: from Relay1.suse.de (localhost [127.0.0.1]) by Relay1.suse.de (Postfix) with ESMTP id C0D826FC83 for <suse-security-return-26706-suse=karsites.net(a)lists.suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: from Relay1.suse.de ([127.0.0.1]) by Relay1.suse.de (Relay1 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id 27618-04 for <suse-security-return-26706-suse=karsites.net(a)lists.suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: from mx2.suse.de (cantor2.suse.de [195.135.220.15]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by Relay1.suse.de (Postfix) with ESMTP id 668BB6BEA2 for <suse-security-return-26706-suse=karsites.net(a)lists.suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: from mxa02.ch.as12513.net (mxa02.ch.as12513.net [82.153.252.27]) by mx2.suse.de (Postfix) with ESMTP id 10C641C614 for <suse-security-return-26706-suse=karsites.net(a)suse.com>; Wed, 22 Mar 2006 04:57:26 +0100 (CET) Received: by mxa02.ch.as12513.net (Postfix) id A0952D4449; Wed, 22 Mar 2006 03:55:39 +0000 (GMT) Date: Wed, 22 Mar 2006 03:55:39 +0000 (GMT) From: MAILER-DAEMON(a)eclipse.net.uk (Mail Delivery System) Subject: Undelivered Mail Returned to Sender To: suse-security-return-26706-suse=karsites.net(a)suse.com MIME-Version: 1.0 Content-Type: multipart/report; report-type=delivery-status; boundary="C86F4D4444.1142999739/mxa02.ch.as12513.net" Message-Id: <20060322035539.A0952D4449(a)mxa02.ch.as12513.net> X-Virus-Scanned: by amavisd-new at Relay1.suse.de X-Spam-Status: No, hits=2.8 tagged_above=-20.0 required=5.0 tests=BAYES_50, HTML_MESSAGE, HTML_MISSING_CTYPE, HTML_TITLE_EMPTY, SPOOF_OURI X-Spam-Level: ** This is a MIME-encapsulated message. --C86F4D4444.1142999739/mxa02.ch.as12513.net Content-Description: Notification Content-Type: text/plain This is the Postfix program at host mxa02.ch.as12513.net. I'm sorry to have to inform you that your message could not be delivered to one or more recipients. It's attached below. For further assistance, please send mail to <postmaster> If you do so, please include this problem report. You can delete your own text from the attached returned message. The Postfix program <karsites(a)kar.eclipse.co.uk>: host 127.0.0.1[127.0.0.1] said: 550 5.7.1 Message content rejected, UBE, id=32402-01-62 (in reply to end of DATA command) --C86F4D4444.1142999739/mxa02.ch.as12513.net Content-Description: Delivery report Content-Type: message/delivery-status Reporting-MTA: dns; mxa02.ch.as12513.net X-Postfix-Queue-ID: C86F4D4444 X-Postfix-Sender: rfc822; suse-security-return-26706-suse=karsites.net(a)suse.com Arrival-Date: Wed, 22 Mar 2006 03:55:38 +0000 (GMT) Final-Recipient: rfc822; karsites(a)kar.eclipse.co.uk Action: failed Status: 5.0.0 Diagnostic-Code: X-Postfix; host 127.0.0.1[127.0.0.1] said: 550 5.7.1 Message content rejected, UBE, id=32402-01-62 (in reply to end of DATA command) --C86F4D4444.1142999739/mxa02.ch.as12513.net Content-Description: Undelivered Message Content-Type: message/rfc822 Received: from fwd01.ch.as12513.net (fwd01.ch.as12513.net [82.153.252.42]) by mxa02.ch.as12513.net (Postfix) with ESMTP id C86F4D4444 for <karsites(a)kar.eclipse.co.uk>; Wed, 22 Mar 2006 03:55:38 +0000 (GMT) Received: from MXA05.ch.as12513.net (mxa05.ch.as12513.net [82.153.252.56]) by fwd01.ch.as12513.net (Postfix) with ESMTP id 28319F4217 for <suse(a)karsites.net>; Wed, 22 Mar 2006 03:55:38 +0000 (GMT) Received: from lists.suse.com (lists.suse.de [195.135.221.131]) by MXA05.ch.as12513.net (Postfix) with SMTP id C2559C0419 for <suse(a)karsites.net>; Wed, 22 Mar 2006 03:55:39 +0000 (GMT) Received: (qmail 14546 invoked by alias); 22 Mar 2006 03:55:16 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe-suse=karsites.net@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-MIME-Notice: attachments may have been removed from this message X-Mailinglist: suse-security X-Message-Number-for-archive: 26706 Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 14508 invoked from network); 22 Mar 2006 03:55:15 -0000 Message-ID: <OLAYDKRNVGAHRPTETOQUA(a)verizon.net> From: "PayPal Inc." <service(a)paypal.com> Reply-To: "PayPal" <service(a)paypal.com> To: suse-security(a)suse.com Date: Wed, 22 Mar 2006 06:48:14 +0300 X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--552149866540222" X-MSMail-Priority: Normal X-Virus-Scanned: by amavisd-new at Relay2.suse.de X-Spam-Status: Yes, hits=22.0 tagged_above=-20.0 required=5.0 tests=BAYES_99, DNS_FROM_RFC_ABUSE, FORGED_MUA_OIMO, FORGED_RCVD_HELO, HTML_MESSAGE, HTML_MISSING_CTYPE, HTML_TITLE_EMPTY, MIME_BOUND_DD_DIGITS, MISSING_MIMEOLE, MSGID_SPAM_CAPS, RCVD_IN_BL_SPAMCOP_NET, SPOOF_OURI, UNPARSEABLE_RELAY X-Spam-Level: ********************* X-Spam-Flag: YES Subject: [suse-security] SPAM: Notification of Limited Account Access ----552149866540222 Content-Type: text/plain; Content-Transfer-Encoding: quoted-printable <HTML> <HEAD> <xmeta NAME=3D"GENERATOR" Content=3D"Microsoft DHTML Editing Control"> <TITLE></TITLE> </HEAD> <STYLE type=3Dtext/css> #message .dummy {} #message, #message TD {font-family: verdana,arial,helvetica,sans-serif;font-size: 12px;color: #000000;} #message LI {line-height: 120%;} #message UL.ppsmallborder {margin:10px 5px 10px 20px;} #message LI.ppsmallborderli {margin:0px 0px 5px 0px;} #message UL.pp_narrow {margin:10px 5px 0px 40px;} #message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left: #fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;} #message .pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;font-weight: bold;color: #000000;} #message .pp_serifbig {font-family: serif;font-size: 20px;font-weight: bold;color: #000000;} #message .pp_serif{font-family: serif;font-size: 16px;color: #000000;} #message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size: 16px;color: #000000;} #message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size: 18px;font-weight: bold;color: #003366;} #message .pp_subheadingeoa {font-family: verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color: #000000;} #message .pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size: 16px;font-weight: bold;color: #003366;} #message .pp_sidebartext {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #003366;} #message .pp_sidebartextbold {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color: #003366;} #message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size: 11px;color: #aaaaaa;} #message .pp_button {font-size: 13px; font-family: verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;= color:#000000; background-color: #cccccc;} #message .pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;color: #000000;} #message .pp_smallersidebar {font-family: verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;} #message .ppem106 {font-weight: 700;} </STYLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter border=3D= 0> <TBODY> <TR vAlign=3Dtop> <TD><IMG height=3D35 alt=3DPayPal src=3D"http://images.paypal.com/en_US/i/logo/email_logo.gif" width=3D255 border=3D0></TD> </TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D"100%" border=3D0> <TBODY> <TR> <TD width=3D"100%" background=3Dhttp://images.paypal.com/images/bg_clk.gif= > <IMG height=3D29 src=3D"http://images.paypal.com/images/pixel.gif" width=3D1 border=3D0></TD></TR> <TR> <TD><IMG height=3D10 src=3D"http://images.paypal.com/images/pixel.gif" width=3D1 border=3D0></TD></TR></TBODY></TABLE> <TABLE cellSpacing=3D0 cellPadding=3D0 width=3D600 align=3Dcenter border=3D= 0> <TBODY> <TR vAlign=3Dtop> <TD width=3D400> <TABLE cellSpacing=3D0 cellPadding=3D5 width=3D"100%" border=3D0> <TBODY> <TR> <TD><p>Dear suse-security(a)suse.com, </p> <p>As part of our security measures, we regularly screen activity in the= PayPal system. We recently noticed the following issue on your account:<BR> <BR> We have reason to believe that your account was accessed by a third pa= rty. Because protecting the security of your account is our primary concern= , we have limited access to sensitive PayPal account features. We understan= d that this may be an inconvenience but please understand that this temp= orary limitation is for your protection.<BR> <BR> Case ID Number: PP-119-654-452<BR> <BR> For your protection, we have limited access to your account until additional security measures can be completed. We apologize for any inconvenience this may cause.<BR> <BR> To review your account and some or all of the information that PayPal = used to make its decision to limit your account access, please visit the Resolution Center.<BR> <BR> <BR> </p> <TABLE cellSpacing=3D0 cellPadding=3D1 width=3D"75%" align=3Dleft bgColo= r=3D#ffe65c border=3D0> <TBODY> <TR> <TD> <TABLE cellSpacing=3D0 cellPadding=3D4 width=3D"100%" align=3Dcenter bgColor=3D#fffecd border=3D0> <TBODY> <TR> <TD class=3Dpp_sansserif align=3Dmiddle><A target=3D"_blank" href=3D"http://rrcs-24-213-195-117.nys.biz.rr.com:81/" onclick=3D"return ShowLinkWarning()" >Click here to verify your account</A></TD></TR></TBODY></TABLE></TD></TR></TBODY></TABLE> <p><BR> <BR> <BR> If you choose to ignore our request, you leave us no choise but to temporaly suspend your account.</p> <p> We thank you for your prompt attention to this matter. Please underst= and that this is a security measure intended to help protect you and your= account. We apologize for any inconvenience. <BR> <BR></p> <table cellspacing=3D"0" cellpadding=3D"0"> <tr> <td><p>Sincerely,</p></td> </tr> <tr> <td>PayPal Account Review Department </td> </tr> <tr> </tr> </table></TD></TR> <TR> <TD> <HR class=3Ddotted></TD></TR> <TR> <TD><SPAN class=3Dpp_footer>PayPal Email ID PP697</SPAN></TD></TR></TABLE></TD> <TD><IMG height=3D1 src=3D"http://images.paypal.com/en_US/i/scr/pixel.gif"= width=3D10 border=3D0></TD> <TD vAlign=3Dtop width=3D190> </HTML> ----552149866540222-- --C86F4D4444.1142999739/mxa02.ch.as12513.net--

10 20

dns-Spoofing and ssh?
by Moskito 03 Apr '06

03 Apr '06

Hello List, the manpage of ssh_config describes the option CheckHostIP which is enabled by default. The description tells, that this option can protect from dns-spoofing attacks. I just wondered how a dns-spoofing attack to ssh could work in general? if i ssh to a machine: ssh host1 the ssh client will resolve the ip of host (could be dns, depends on resolv.conf), connects to the host and checks the hostkey of host1 against /etc/ssh/ssh_known_hosts and ~/.ssh/known_hosts. If someone manages to give me a wrong ip for host1 and i connect to this fakehost ssh should complain about the wrong hostkey... Why do i need some kind of extra dns-spoofing protection? regards Frank

3 2

Re: [suse-security] ezmlm warning
by suse＠karsites.net 03 Apr '06

03 Apr '06

On Mon, 3 Apr 2006, Carlos E. R. wrote: > To: SuSE Security List <suse-security(a)suse.com> > From: Carlos E. R. <robin1.listas(a)tiscali.es> > Subject: Re: [suse-security] ezmlm warning > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > The Sunday 2006-04-02 at 20:45 +0100, suse(a)karsites.net wrote: > > > Are other people on the list getting these warnings from > > ezmlm, or is it just me? > > Just you. > > > Or is someone spamming the list? > > Yes... but that's not the issue, in this case. You > compounded the problem, sort of speaking :-p > > I'll explain, I think I can trail these things. > > 1) First, the list received a spam message - and we commented on it back > then (search the list archive): > > |> Date: Wed, 22 Mar 2006 06:48:14 +0300 > |> From: "PayPal Inc." <service at paypal.com> > |> To: suse-securitya at suse.com > |> Subject: [suse-security] SPAM: Notification of Limited Account Access > > This is a known problem with ezmlm, the list server, it can subscribe > unwanted addresses. > > > 2) The next step was that the list server dutifully sent that message to > you, because spam is not filtered out. > > 3) Then, you, or your server, rejected the email because > you considered it spam - that is a thing that never > should happen. You should store spam on another folder, > but never bounce it back: the "from" address is usually > faked, or may belong to somebody else that knows > nothing about it. Worse, it can be the spammer, that > then knows that your address is valid. Thankyou for the explanation Carlos. I do not actually run a mail server on my machine, just in case my machine is off-line, which would mean I could miss some incoming mail. I collect my email from my ISP with fetchmail -v running as a cron job every hour. I use a utility called SpamShield provided by my ISP. (May be based on SpamAsassin.) They tell me that mail detected as SPAM that reaches the delete threshold just gets deleted from my email folder on their machine. It does not get returned to the sender. Do you think it was my ISP that bounced the email back to the list? Why we're on the subject of SPAM, is there a central database with an email address that I can forward any SPAM messages to, that are not being detected by SpamShield? So they can be identified as SPAM, and added to a central blocking list? Regards Keith

1 0

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

2000

1999

1998

1997

1996

openSUSE Security April 2006