June 2000 - openSUSE Users - openSUSE Mailing Lists

[SLE] WUFTPD exploit
by cwhitten＠intop.net 27 Jun '00

27 Jun '00

---------- Forwarded message ---------- Date: Fri, 23 Jun 2000 09:18:22 -0000 From: Lamagra Argamal <lamagra(a)HACKERMAIL.NET> To: BUGTRAQ(a)SECURITYFOCUS.COM Subject: ftpd: the advisory version The story begins inside the ftpcmd.y file. Which has the ftp commands in it. The bug is in the site_exec(char *cmd) function. There is calls lreply(200,cmd); In ftpd.c we find void lreply(int n, char *fmt,...) .... vvreply(USE_REPLY_LONG, n, fmt, ap) ... and void vreply(long flags, int n, char *fmt, va_list ap) ... vvsnprintf(buf + (n ? 4 : 0), n ? sizeof(buf) - 4 : sizeof(buf), fmt, ap) .... cmd becomes fmt with vsnprintf that's bad. The idea is to put in formatstrings to get some extra priviledges. We can use %n to overwrite some stuff. eg. overwrite a ret-address or a null at the end of a buffer (cause an overflow) or change the configuration or uid like I did in my proftp exploit (check proftp_pcc.c on Packetstorm). There are some other bugs in site_exec like for (t = cmd; *t && !isspace(*t); t++) { if (isupper(*t)) { *t = tolower(*t); } } Sanitizing stops at a space?? (good thing I didn't tell you this, eh tf8) Wuftpd is all really buggy code. I prefer proftpd, it has clean, readable code and it's quite secure. I did some checking and found some minor bugs there too First in modules/mod_pam.c /* Allocate our entries...we don't free this because PAM does this for us. */ pam_user = malloc(strlen(cmd->argv[0]) + 1); if(pam_user == (char *)0) return pam_return_type ? ERROR(cmd) : DECLINED(cmd); sstrncpy(pam_user, cmd->argv[0], strlen(cmd->argv[0]) + 1); pam_pass = malloc(strlen(cmd->argv[1]) + 1); Pam doesn't free these according to me. So this could lead to a pottential system DoS if abused. Fortunatly proftpd has a limit of 3 on USER/PASS. Second: In the set_proc_title(char *fmt,...) function in main.c It constructs a buffer with hostname + user + cmd to replace argv[0]. If setproctitle(char *fmt,...) is available (only on debian and bsd). It calls setproctitle(statsbuf); what re-opens the old bug Not a big thing since almost nobody has it. -- Chad Whitten chadwick(a)intop.net -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

2 1

RE: [SLE] Zoom 2919 initialization strings
by tduggan＠dekaresearch.com 27 Jun '00

27 Jun '00

Hi, -----Original Message----- From: John Anderson [SMTP:jkanders@alpha.delta.edu] Sent: Sunday, June 25, 2000 10:49 PM >I have a zoom 2919 internal ISA modem and I cannot get the correct >initialization string. Wvdial 1.41 cannot detect that modem, so I used >a generic setting. The result is I get a stalling problem when I reach >certain sites such as my ISP. I have contacted Zoom and they gave >me about 50 different strings, but none seem to work correctly. >Anyone successful in configuring this modem? First a few quick questions, does it have a flashable rom? If so, did you try updating it? (I had alot of problems with an early 2919 which went away after the update.) Is the modem set up to use the jumpers or for PNP? IIRC there are two flavors of the 2919, one uses a Rockwell chip and the other is Lucent. Do you know which it is? There should be a sticker next to the phone line port with the serial number, if not inspect the card itself for the number. Then follow the support links at http://www.zoom.com to find the proper id. From memory i think it would look like Znnnn-nnL or Znnnn-nnM (where n is any integer) for a Lucent chip. Also on the support site are some downloadable files containing the differences between the two chips. I have recently set up one of the Lucent models under SuSE 6.4. I set it (with jumpers) for ttyS2/com3 (i/o 3E8 I think), irq 5 and ran setserial /dev/ttyS2 irq5 spd_vhi I made sure /dev/modem points to the right place. I had to hand edit /etc/wvdial.conf since for some reason the wvdial configuration utility would not find the modem properly. I made no changes to the default initialization string and had no problem dialing or connecting with either wvdial or kppp. I once came across a modem site that pointed out a lot of problems with the flash in various modems, if I find the link I'll forward it to you. That's all I can think of for now. Good luck Tim -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

2 1

[SLE] Unwelcome warnings from include files
by pinard＠iro.umontreal.ca 27 Jun '00

27 Jun '00

Hello. While compiling some `getopt.c' using SuSE 6.4 (gcc), I see: /usr/bin/gcc -DHAVE_CONFIG_H -I. -I../../lib -I.. -I.. -I../../lib -pedantic -Wall -Wtraditional -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wconversion -Wwrite-strings -Wnested-externs -g -O2 -c ../../lib/getopt.c In file included from /usr/include/string.h:346, from ../../lib/error.c:45: /usr/include/bits/string2.h: In function `__strcpy_small': /usr/include/bits/string2.h:419: warning: pointer of type `void *' used in arithmetic /usr/include/bits/string2.h:427: warning: pointer of type `void *' used in arithmetic /usr/include/bits/string2.h:432: warning: pointer of type `void *' used in arithmetic /usr/include/bits/string2.h:437: warning: pointer of type `void *' used in arithmetic /usr/include/bits/string2.h:439: warning: pointer of type `void *' used in arithmetic /usr/include/bits/string2.h:444: warning: pointer of type `void *' used in arithmetic /usr/include/bits/string2.h: In function `__strsep_g': /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c2' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 2 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 3 of `__strpbrk_c3' with different width due to prototype /usr/include/bits/string2.h:1171: warning: passing arg 4 of `__strpbrk_c3' with different width due to prototype I do try to keep my own sources "warning-clean", and would be tempted to hope that system include files share this quality as well. Is my hope reasonable? -- François Pinard http://www.iro.umontreal.ca/~pinard -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

2 1

[SLE] Re install
by pjpieczora＠sympatico.ca 27 Jun '00

27 Jun '00

Hi, When installing linux I get following error message: crc error --System Halted_ Does it mean that motherboard is faulty or incompatible? Peter -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] Linux, GPIB, and Java (off topic)
by europax＠home.com 27 Jun '00

27 Jun '00

Has anyone here used or heard of anyone using Java for controlling a GPIB card on a Linux box, or any other OS for that matter? I spent a lot of time searching the net, but haven't found anything. I realize that in such an application there has to be some native code that Java calls to access the hardware. I know that a lot of people are using Perl as a cross-platform language for controlling GPIB. Thanks, Rob. -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] Banning a Domain
by admin＠brevsville.com.au 27 Jun '00

27 Jun '00

Is there any way I can completly ban a domain from any kind of interaction with my server? Thanx Chris -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

3 2

RE: [SLE] (!&@#(*& Voodoo3 troubles
by bigboote＠mediaone.net 27 Jun '00

27 Jun '00

Try taking the "SST_PCIRD=1" line out. I had problems similar to yours until I removed that line. Good luck. > Greetings. > > I've a pile of trouble convincing a Voodoo3 3000 to work it's > evil Voodoo > magic in SuSE 6.2. A while ago there was a post on the topic > in response to > a mail I sent about the Voodoo and an SB Live. I'm grateful for the > response as it has helped.. somewhat. > > The Voodoo *does* work it's magic a little bit. For example > I've built a > recent version of xlock against the MesaGL libs and the 3dfx > modes work > pretty well (tho one or two are slow as shi*t). However, > kewl things like > quake2 constantly misbehave. Some deatils: > > I've installed glide and mesa stuff from the SuSE 6.2 CDs. I've also > grabbed the 3dfx device source and rebuilt it for my > currently kernel. I > try running quake2 with a script that looks sort of like this: > > #!/bin/bash > cd /usr/local/quake2 > > # For meaning of MESA environmental variables see README.3dfx > in the mesa > source. > export MESA_FX_INFO=1 > export MESA_GLX_FX=fullscreen > > export FX_GLIDE_SWAPINTERVAL=0 > > export SST_SWAP_EN_WAIT_ON_VSYNC=0 > export SST_VSYNC=0 > export SST_FASTPCIRD=1 > export SST_FASTMEM=1 > export SST_PCIRD=1 > > export SSTH3_SWAP_EN_WAIT_ON_VSYNC=0 > export SSTH3_VSYNC=0 > export SSTH3_FASTPCIRD=1 > export SSTH3_FASTMEM=1 > export SSTH3_PCIRD=1 > > ./quake2 \ > +set vid_ref glx \ > +set gl_driver libMesaGL.so.3 \ > +set gl_mode 6 \ > +set vid_fullscreen 1 > > > Yes, I run this in X because, apparently, the Voodoo3 only > does 3dfx tricks > from within X. libMesaGL.so.3 is the shared library from the > Mesa package > on the SuSE cds, NOT the one distributed with the quake2 > binary from id > software. Everything starts up, but there is a problem: No > textures. The > walls and other surroundings have textures, but the > characters (enemies, > etc) do not. They look like white crash test dummies. :p > > > Any ideas what could be a problem here? Also, gl_mode 6 is > 1024x768. I > tried gl_mode 3 which is 640x480 and that was even worse. > Screen looked > like rainbow static. :) > > > Any help would be appreciated as usual! > > Regards, > kw > > /* Keith Warno > ** Developer & Sys Admin > ** http://www.HaggleWare.com/ > */ > > > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to > suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/ > -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

RE: [SLE] libext2fs.so
by bigboote＠mediaone.net 27 Jun '00

27 Jun '00

Yup, and actually succeeded too. Woo-hoo! > > > What package includes libext2fs.so? > > This sounds like a man trying to install GNOME! I just went > through the same thing. You can, apparently, get the library > from the SuSE-6.3 helix distribution in package > > e2fslibs-1.17-1_helix_3 > > I've not tried it myself. > > -- > To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com > For additional commands send e-mail to > suse-linux-e-help(a)suse.com > Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/ > -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

RE: [SLE] Naff System ???
by pcgoober＠mninter.net 27 Jun '00

27 Jun '00

Hey Mike, Fellow Win native here that has experienced quite a bit of the same frustration as you are going through now but there is light on the horizon... First: you need to abandon the "Windows" way of thinking. Linux seems very complex but that is only because the details which should have been left up to us have always been made for us by Mr. Bill. Second: Start simple! I tried to do everything in one fail swoop and found that it was imminent disaster and had to start over. I recommend having a separate crappy machine with enough HD to hold a working setup so you can still go back to the Win box to find solutions quickly and get work done. Depending on what you want to use Linux for, I would recommend setting up an office server and learn how to use DHCP, firewall and other networking daemons first. You will come to find you don't need to choose between Windows or Linux because you will have them both which is very important as you will find out eventually. Third: Don't give up! The answer is there you sometimes need to wade through some immense piles of literature to find your answers but they are there. There is always this list and I have found someone will answer your question if they know the answer. I started with (and still have) SuSE 6.3 and would be happy to provide you with any feeble help I may be able to muster. FYI: (My Setup) Linux 6.3 server with 2 NICS, firewall directed to a DSL connection. Internal dual NT/Win95 box (soon to be a few more clients) connected to server with DHCP, Samba, etc. Currently setting up Half-Life server on it so I can host some propeller-head parties. It has taken a long time to get a good working config but I have learned a substantial amount about networking, Linux and (surprisingly) Windows from it. PcGoober The quest for platform interoperability may cause any or all of the following: divorce impotence grey hair bankruptcy loss of job heavy alcohol consumption headache blindness undying urge to torch Win box ************************************************************************ *********************** On Monday, June 26, 2000 7:15 PM, mike [SMTP:charlie@centrenet.co.uk] wrote: > Hi All, > I'm a newbie to Linux, formerly DR-Dos, MS-Dos, W3.1, W3.11, W95, W98, NT. > > ANY help appreciated, BUT if this is the "normal" state of affairs with the > Linux system then I think that "Uncle Bill" can sleep soundly at night, it's > a "no contest" to Microshaft with all it's faults. > > Sorry about the moans but I'm getting very frustrated. > > Cheers > Mike -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

1 0

[SLE] Re: gnucash 1.4.1
by landie＠concentric.net 27 Jun '00

27 Jun '00

i just installed guile.rpm from suse and i still get this error as far as i see both of those libs are in my system root@Ptorico:/home/landy/rpms > rpm -Uvh gnucash-1.4.1-1.i386.rpm error: failed dependencies: libguile.so.4 is needed by gnucash-1.4.1-1 libreadline.so.3 is needed by gnucash-1.4.1-1 root@Ptorico:/home/landy/rpms > On Mon, 26 Jun 2000, Jeremy Collins wrote: > Alright... this release is up on gnucash.org and sourceforge.net. > > ftp://ftp.gnucash.org/pub/gnucash/ > http://download.sourceforge.net/gnucash/ > > download.sourceforge.net only carries the latest release. Once I have > mirroring setup ftp.sourceforge.net will carry the full ftp site. > Release notes are below. > > Enjoy! > > -- > Jeremy Collins, Web Developer > LinuxMall.com > jeremyc(a)linuxmall.com > jcollins(a)gnucash.org > > Dave Peticolas wrote: > > > > Hi Jeremy, there is a new 1.4.1 release. > > > > Here are some of the changes from 1.4.0: > > > > o translations are loaded correctly > > o improved qif importing > > o bug fixes > > > > The rpms and tarball are available at: > > > > -- > Gnucash Developer's List > To unsubscribe send empty email to: gnucash-devel-unsubscribe(a)gnucash.org -- Rolando Roman icq 3783184 -- To unsubscribe send e-mail to suse-linux-e-unsubscribe(a)suse.com For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the FAQ at http://www.suse.com/Support/Doku/FAQ/

2 1