Linuxers January 2003

linuxers@mm.ilug-bom.org.in

124 participants
197 discussions

LCD Projector Drivers
by P.V. Mohan Krishnan 14 Jan '03

14 Jan '03

Can anyone guide regarding references for Linux drivers to support USB connection for mouse usage on Philips BSURE SV1 LCD Projector under Linux. Windows senses the system at time of booting when the system is connected to the projector using USB cable. - Mohan Krishnan

3 4

pay for 1 Xeon and get 2
by Trevor Warren 14 Jan '03

14 Jan '03

Check the link out.... http://www-106.ibm.com/developerworks/linux/library/l-htl/?ca=dgr-lnxw03Hyp… Code in the 2.5* series of the gnu-linux kernel for Hyperthreading on Xeon processors improves performance by 50%. Trevor

3 2

ssh chroot
by Amish Munshi 14 Jan '03

14 Jan '03

Hi, Is it possible to chroot a user who does an ssh into the server to his own home directory? Bye.

2 1

MUMBAI: Two day workshop on "Open Source - The Revolutionary Approach" on 17th & 18 Jan- 2003.
by FREDERICK NORONHA 14 Jan '03

14 Jan '03

Thanks to "Venkatesh \(Venky\) Hariharan" <venky(a)media.mit.edu> for forwarding... ----- Original Message ----- From: CSI Mumbai Chapter Sent: Friday, January 01, 1999 9:45 AM Subject: Two day workshop on "Open Source - The Revolutionary Approach" on 17th & 18 Jan- 2003. COMPUTER SOCIETY OF INDIA Mumbai Chapter Presents A two day comprehensive workshop on Open Source - The Revolutionary Approach On 17th & 18th January 2003, Time : 10.00 a.m. to 5.00 p.m. INTRODUCTION : Helping the industry discover the benefits of Open Source Technology One of the biggest developments in software during the past decade has been the growth of the open-source software movement. The Open Source movement is an extremely powerful model for software development and advancement, and emerging economies like India particularly have a lot to gain from adopting it. "In the information age, value is based not on scarcity but on familiarity" - This is the seed thought for the movement. Open Source technologies is a term used to define those technologies which is available to the public in source code form, and which does not have licensing restrictions Open Source software generally is distributed under a license that guarantees the right to read, modify, redistribute and use the software freely. Much of the open source software is distributed under the GNU General Public License (GNU GPL). Open Source is doing what GOD, government and market have failed to do. It is putting powerful technology within the reach of cash poor but idea-rich people. And, YESThat is Revolutionary!!! Linux and the Open Source Movement have been developing rapidly in recent years and are now seen as serious competitors to Microsoft. There are millions of user/s world-wide. Some of most successful and robust software on the web today has been developed under this license. IBM and Oracle are now among the 'big names' supporting Linux and have released Linux versions of their database server products. A high-powered lab has been set up to encourage open source development and research. Among the sponsors are Dell, Fujitsu, IBM, Hewlett-Packard, Hitachi, Intel, NEC, Mitsubishi, Red Hat and SGI. The Indian government, too, is planning a countrywide campaign to promote the use of Open Source software as the "platform of choice". The Department of Information Technology has already devised a strategy to introduce Linux and open source software as a de-facto standard in academic institutions, especially in engineering colleges through course work that encourages use of such systems. Research establishments would be advised to use and develop re-distributable toolboxes just as Central government departments and state governments would be asked to use Linux-based offerings. OBJECTIVES To understand the Open Source Technology and achieve clarity of thinking for making cost-effective information technology based decisions. A further take-home would be a freedom of choice on decisions of softwares and an insight into the value-added benefits of the Open Source Technology. WHO SHOULD ATTEND CIOs, CEOs, CTOs, Head of ITs, IT Managers and IT Consultants. WORKSHOP DETAILS The workshop is designed to give a holistic picture of the Open Source Technology domain. It is designed to help one understand the various pros and cons attributable to Proprietary softwares vis-à-vis Open source based softwares. The workshop will start with the basics of Open Source followed by case studies of organisations who have adopted Open Source Technology (eg. Times Of India, Bajaj, Skypak Couriers, etc). Then we will look into the pros and cons of using Open source based softwares. In the wake of these, we will see the problems faced in the implementation of Open source solutions. Here we will look at resource management and tacit knowledge. After this, we will look at the state of the art in technology. The workshop will consist of impromptu discussion sessions, so that there is a forum to share experiences. There will be lots of case studies and demonstrations throughout the workshop. CONTENTS : 1. STEPPING INSIDE THE WORLD OF OPEN SOURCE a.. WHAT IS OPEN SOURCE? b.. WHAT IS FREE? c.. DIFFERENCE BETWEEN FREE & OPEN SOURCE d.. LICENSE - GNU & OTHERS e.. FLOSS 2. OPEN SOURCE INTEGRATORS: A LARGER VIEW ON THE OPEN SOURCE SOFTWARES a.. OPERATING SYSTEM- a.. LINUX- b.. MICRO LINUX c.. DIFFERENT DISTRIBUTORS (RED HAT, CALDERA, DEBIAN ET AL) b.. DATABASE- a.. MySQL- b.. SAP DB c.. POSTGRES SQL d.. SQL LITE e.. ORACLE c.. PROGRAMMING LANGUAGES- a.. JAVA- b.. PHP c.. PYTHON d.. AUBIT 4GL- e.. PERL f.. OTHERS (AWK, SED, BASH) d.. LIBRARIES- AN OVERVIEW ( PHPLIB, PERL DBI, PHP GEM) e.. DOCUMENTORS (DIA) f.. TESTING TOOL 3. OPEN SOURCE BASED UTILITIES a.. VNC b.. PHP - PROJECT 4. OPEN SOURCE FOR END USERS a.. GNU CASH - AN ACCOUNTING PACKAGE b.. OFFICE SUITES 5. NETWORKING THE WORLD a.. LINUX WITH OTHER NETWORKS - SAMBA, MARSNWE b.. MAIL SERVER c.. PROXY (SQUID) d.. LINUX ROUTER 6.EMBEDDED LINUX 7.WAP BASED APPLICATION DEVELOPMENT WITH KANNEL 8. COST SAVING METHODOLOGIES - LTSP 9. THE ROAD AHEAD SPEAKER : Mr. T. Srinivas Reddy, founder, Optimal Solution Providers, is an MCS from the Inter Disciplinary School of Scientific Computing (ISSC) Pune. He is an expert in networking, designing architectures and building web based applications using the Open Source Technology. He has garnered significant expertise in handling various Software Turn Key projects with complete solutions, providing implementation support to off-shore as well as local clients, handling Off-shore Recruitment & imparting computer based training to various professionals such as Doctors, Railway Police Staff, MBA/MCA Students, etc. Driven with an objective to contribute to the world of open source by creating awareness about the open source technologies, he has implemented numerous Open Source software based applications in various organizations such as Konkan Railway Corporation of India, Bajaj Electricals, Western Outdoors, Skypak Couriers, Wilson Greetings, et al. Last, but not the least, a testimony to his endeavor is the successful creation of an environment facilitating the freedom to choose (the seed thought of the Open Source Movement) amongst all his valued clientele Registration Fees: CSI Member : Rs. 2000/- Other : Rs. 2500/- ( Registration Fees covers sessions, Courseware , Lunch & Tea / Coffee ) Cheque should be in favour of "CSI - Mumbai Chapter" Venue, Please Register with : Rajendra Munge Computer Society of India - Mumbai Chapter E -217, Floral Deck Plaza, Near Seepz, Andheri East, Mumbai - 400 093 Tel: 28235476 / 5548 Fax: 28235546 Email: info(a)csimumbai.org / csimumb(a)bom5.vsnl.net.in www.csimumbai.org -------------------------------------------------------

1 0

Re: [ILUG-BOM] Hathway cable modem - high download counts
by Sitaram Chamarty 13 Jan '03

13 Jan '03

> Message: 4 > Date: Sun, 12 Jan 2003 11:28:55 -0500 (EST) > From: Rajesh Deo <rajeshdeo(a)earthlink.net> > Check your firewall configuration, misconfigured firewalls can generate > unwanted ARP packets. Don't know about your double counting problem > though. The ARP packets are always from the "gateway" to machines in the same subnet that are not online. For instance, Sundays evenings (when most machines are probably up and "surfing") I see much less of this! Weird... huh? Regards, Sitaram

1 0

Bulletien Board
by Vidyasagar Venkatesh 13 Jan '03

13 Jan '03

I have installed a free PHP bulletien board on a free website where topics can be discussed.... the website address is.. http://itforums.ionichost.com

1 0

[Fwd: New Digital Forensic resource]
by Trevor Warren 13 Jan '03

13 Jan '03

-----Forwarded Message----- From: Christine Siedsma <csiedsma(a)utica.edu> To: forensics(a)securityfocus.com Cc: crime(a)cs.pdx.edu, Csquad(a)c-squad.org, InternetCrime-L(a)yahoogroups.com Subject: New Digital Forensic resource Date: 08 Jan 2003 11:13:06 -0500 Greetings, Sorry for the cross-posting, but I wish to share this with and get reaction from as many people as possible regarding this effort. I have created a new website www.e-evidence.info Most of the content is there now, and the rest should be up by the end of the week. The site is an organized compilation of "bookmarks" related to Digital Forensics. This IS NOT a commercial site. There are no affiliations with services or products. This is a purely academic effort. Please feel free to visit and make use of the resources. PS Sorry about the banner, but I 'went cheap' Christine Siedsma Program Manager Computer Forensic R&D Center Utica College of Syracuse University Utica, New York 315-792-3708 ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

1 0

[Fwd: MDKSA-2003:001 - Updated CUPS packages fix multiple vulnerabilities]
by Trevor Warren 13 Jan '03

13 Jan '03

-----Forwarded Message----- From: Mandrake Linux Security Team <security(a)linux-mandrake.com> To: bugtraq(a)securityfocus.com Subject: MDKSA-2003:001 - Updated CUPS packages fix multiple vulnerabilities Date: 10 Jan 2003 06:00:22 +0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ Mandrake Linux Security Update Advisory ________________________________________________________________________ Package name: cups Advisory ID: MDKSA-2003:001 Date: January 9th, 2003 Affected versions: 7.2, 8.0, 8.1, 8.2, 9.0 ________________________________________________________________________ Problem Description: iDefense reported several security problems in CUPS that can lead to local and remote root compromise. An integer overflow in the HTTP interface can be used to gain remote access with CUPS privilege. A local file race condition can be used to gain root privilege, although the previous bug must be exploited first. An attacker can remotely add printers to the vulnerable system. A remote DoS can be accomplished due to negative length in the memcpy() call. An integer overflow in image handling code can be used to gain higher privilege. An attacker can gain local root privilege due to a buffer overflow of the 'options' buffer. A design problem can be exploited to gain local root access, however this needs an added printer (which can also be done, as per a previously noted bug). Wrong handling of zero-width images can be abused to gain higher privilege. Finally, a file descriptor leak and DoS due to missing checks of return values of file/socket operations. MandrakeSoft recommends all users upgrade these CUPS packages immediately. ________________________________________________________________________ References: http://www.idefense.com/advisory/12.23.02.txt ________________________________________________________________________ Updated Packages: Linux-Mandrake 7.2: f17c83eb8ccb6bb618b3a4dab7a9bbc4 7.2/RPMS/cups-1.1.18-1.4mdk.i586.rpm ed0029788b6b296bb05581eff46f5729 7.2/RPMS/cups-devel-1.1.18-1.4mdk.i586.rpm 00def624c71687b8827241933958a808 7.2/RPMS/cups-serial-1.1.18-1.4mdk.i586.rpm 4dff4f9e6fc7eac07d22945d1469a8f4 7.2/RPMS/printer-testpages-1.1.18-1.4mdk.i586.rpm 83b2da7301cedff6d59c3df2a96a39a2 7.2/SRPMS/cups-1.1.18-1.4mdk.src.rpm Mandrake Linux 8.0: 1d541f2d3c992e627925e87c54209a40 8.0/RPMS/cups-1.1.18-1.4mdk.i586.rpm 6af8ee1580fbe69c1f08b569f21ba161 8.0/RPMS/cups-common-1.1.18-1.4mdk.i586.rpm d345d490a90c3cad7f31e80af294c7db 8.0/RPMS/cups-serial-1.1.18-1.4mdk.i586.rpm 15d3a86224bf59e03b1866e569dc54c6 8.0/RPMS/libcups1-1.1.18-1.4mdk.i586.rpm ba587bd4e9f746ee3a5281bb1e9be219 8.0/RPMS/libcups1-devel-1.1.18-1.4mdk.i586.rpm b623a022104d1eb83408ea105dd16668 8.0/RPMS/printer-testpages-1.1.18-1.4mdk.i586.rpm 83b2da7301cedff6d59c3df2a96a39a2 8.0/SRPMS/cups-1.1.18-1.4mdk.src.rpm Mandrake Linux 8.0/PPC: df84b1c335a69b0b90b5d96ab94bcd0b ppc/8.0/RPMS/cups-1.1.18-1.4mdk.ppc.rpm 27e585a501be4b93bbaedcacbddf67b6 ppc/8.0/RPMS/cups-common-1.1.18-1.4mdk.ppc.rpm e4fd8b352d7d2a42d56c779743884c5c ppc/8.0/RPMS/cups-serial-1.1.18-1.4mdk.ppc.rpm a0763833fffaf609f42dca58879a53d5 ppc/8.0/RPMS/libcups1-1.1.18-1.4mdk.ppc.rpm 889bc806ee2812c4f5b102f5dd46dbb6 ppc/8.0/RPMS/libcups1-devel-1.1.18-1.4mdk.ppc.rpm eb72f554fa1cc4961a5e3d99b286728e ppc/8.0/RPMS/printer-testpages-1.1.18-1.4mdk.ppc.rpm 83b2da7301cedff6d59c3df2a96a39a2 ppc/8.0/SRPMS/cups-1.1.18-1.4mdk.src.rpm Mandrake Linux 8.1: c0cd7bc047fffef9f1478fdb5722e2e6 8.1/RPMS/cups-1.1.18-1.4mdk.i586.rpm c852340e8fcbf5750f8733369a213d08 8.1/RPMS/cups-common-1.1.18-1.4mdk.i586.rpm 6cf9f3ffc2128af26adc4ed1e106cea0 8.1/RPMS/cups-serial-1.1.18-1.4mdk.i586.rpm 672fb16ff0e0d8591495d629df7ca822 8.1/RPMS/libcups1-1.1.18-1.4mdk.i586.rpm 69fc4fee7eeb0bab6efceca3a8614018 8.1/RPMS/libcups1-devel-1.1.18-1.4mdk.i586.rpm 83b2da7301cedff6d59c3df2a96a39a2 8.1/SRPMS/cups-1.1.18-1.4mdk.src.rpm Mandrake Linux 8.1/IA64: d4bb657b04b221ccb051fdf2dd883a11 ia64/8.1/RPMS/cups-1.1.18-1.4mdk.ia64.rpm 557bd96819f68ba32249575d3c0c20ae ia64/8.1/RPMS/cups-common-1.1.18-1.4mdk.ia64.rpm 1736860843b7c8890b62488b4452f136 ia64/8.1/RPMS/cups-serial-1.1.18-1.4mdk.ia64.rpm d47285ab40a8885586847a0998a9bf69 ia64/8.1/RPMS/libcups1-1.1.18-1.4mdk.ia64.rpm 87df36264d25ddc4389c04c9f097540d ia64/8.1/RPMS/libcups1-devel-1.1.18-1.4mdk.ia64.rpm 83b2da7301cedff6d59c3df2a96a39a2 ia64/8.1/SRPMS/cups-1.1.18-1.4mdk.src.rpm Mandrake Linux 8.2: 281f89ef9155e2e430396831be7b3087 8.2/RPMS/cups-1.1.18-1.1mdk.i586.rpm 1e982869c576e5a78665f9d28ff462b1 8.2/RPMS/cups-common-1.1.18-1.1mdk.i586.rpm 7d1db740b9675b9419468a351f798775 8.2/RPMS/cups-serial-1.1.18-1.1mdk.i586.rpm c7f1531bd7dd52182efe9131fb12c5cc 8.2/RPMS/libcups1-1.1.18-1.1mdk.i586.rpm 6d8cf127ddd11ab1e63bc099428faea3 8.2/RPMS/libcups1-devel-1.1.18-1.1mdk.i586.rpm 7f494bb95a0d9cc192ab0131fae0dc17 8.2/SRPMS/cups-1.1.18-1.1mdk.src.rpm Mandrake Linux 8.2/PPC: 139e03bb8ad5d289aea18019e1f4e712 ppc/8.2/RPMS/cups-1.1.18-1.1mdk.ppc.rpm 8f27010ecaafecd149fe8e9601c38fc2 ppc/8.2/RPMS/cups-common-1.1.18-1.1mdk.ppc.rpm 0ff1eb72262b02a1792d98abb382e54f ppc/8.2/RPMS/cups-serial-1.1.18-1.1mdk.ppc.rpm c57decc1cbe9d09da520f318b2271858 ppc/8.2/RPMS/libcups1-1.1.18-1.1mdk.ppc.rpm 7987af72a8a13bbed6810f2624b32a2c ppc/8.2/RPMS/libcups1-devel-1.1.18-1.1mdk.ppc.rpm 7f494bb95a0d9cc192ab0131fae0dc17 ppc/8.2/SRPMS/cups-1.1.18-1.1mdk.src.rpm Mandrake Linux 9.0: 0278e384637506da4e04c32a8360b00c 9.0/RPMS/cups-1.1.18-1.1mdk.i586.rpm 004827e4003c13d58d91e2d275cbf8ee 9.0/RPMS/cups-common-1.1.18-1.1mdk.i586.rpm 488d6bdc022901905788551891b7fa86 9.0/RPMS/cups-serial-1.1.18-1.1mdk.i586.rpm 6fc9095ffcc42b768528364b0ec05ea8 9.0/RPMS/libcups1-1.1.18-1.1mdk.i586.rpm 78bb67665b6c8df9029826c22cdd0bda 9.0/RPMS/libcups1-devel-1.1.18-1.1mdk.i586.rpm 7f494bb95a0d9cc192ab0131fae0dc17 9.0/SRPMS/cups-1.1.18-1.1mdk.src.rpm ________________________________________________________________________ Bug IDs fixed (see https://qa.mandrakesoft.com for more information): ________________________________________________________________________ To upgrade automatically, use MandrakeUpdate. The verification of md5 checksums and GPG signatures is performed automatically for you. If you want to upgrade manually, download the updated package from one of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of FTP mirrors can be obtained from: http://www.mandrakesecure.net/en/ftp.php Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command: rpm --checksig <filename> All packages are signed by MandrakeSoft for security. You can obtain the GPG public key of the Mandrake Linux Security Team from: https://www.mandrakesecure.net/RPM-GPG-KEYS Please be aware that sometimes it takes the mirrors a few hours to update. You can view other update advisories for Mandrake Linux at: http://www.mandrakesecure.net/en/advisories/ MandrakeSoft has several security-related mailing list services that anyone can subscribe to. Information on these lists can be obtained by visiting: http://www.mandrakesecure.net/en/mlist.php If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team <security linux-mandrake.com> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.7 (GNU/Linux) mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7 WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg 2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy /NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPaIRgQQEQIA BgUCPI+UAwAKCRDniYrgcHcf8xK5AKCm/Mq8qP8GE0o1hEX22QsJMZwH5gCfZ72H 8TacOb3oAmBdprf+K6gkdOiIRgQQEQIABgUCOtOieAAKCRCv2bZyU0yB80MeAJ9K +jXt0cKuaUonRU+CRGetk6t9dgCfTRRL6/puOKdD6md70+K5EBBSvsG0OE1hbmRy YWtlIExpbnV4IFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QG1hbmRyYWtlc29mdC5j b20+iFcEExECABcFAjyPnuUFCwcKAwQDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmFi+ AJsHhohgnU3ik4+gy3EdFlB2i/MBoACg6lHn5cnVvTcmgNccWxeNxLLZI5e5AQ0E OWnn7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ 9F779FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzR xBXVJb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z 269s+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN 6SCXVl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZ jTcl3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo 0NAiRYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJ EJGXlA== =yGlX - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE+HmF2mqjQ0CJFipgRAjiwAKDWmzgKyOQSvKf2pN8/9gKjhTJeSwCfS2ak JGRb3Q1TDc9deTVuwh//eew= =O0L8 -----END PGP SIGNATURE-----

1 0

More information regarding Etherleak.......CERT
by Trevor Warren 13 Jan '03

13 Jan '03

Hello luggers, got this off SecurityFocus. See if you figure out how much we gnu-liux users are infected.......if and to what extent. Bye for now. Trevor -----Forwarded Message----- From: Ofir Arkin <ofir(a)sys-security.com> To: bugtraq(a)securityfocus.com Subject: More information regarding Etherleak Date: 10 Jan 2003 19:02:43 +0200 This e-mail's purpose is to clear several issues surrounding the Etherleak paper: - Who is Vulnerable? - Why this vulnerability is so wide spread? - Why the examples are only with Linux device drivers? - Why we have contacted CERT? - Are Device Drivers under Microsoft-based OSs are vulnerable? - How can you test your network card and device driver? - Why is this better then a sniffer? - Why the vulnerability is important? Who is vulnerable? ------------------ Josh Anderson and I tested several Ethernet cards and device drivers. We have found several device drivers which are vulnerable but we never attempted to find them all. It is simply because there are too many. Therefore we have contacted CERT more than 6 months ago and sent them the Etherleak paper and asked them to contact OS manufactures, Network device manufactures, Chipset manufactures, motherboard manufactures and other manufactures and vendors who might need to check their device driver's implementations. In our tests we have experienced this bug under 4 different operating systems: - Linux - NetBSD - FreeBSD - Microsoft Windows One of the Ethernet cards and device drivers we have tested was a Compaq PCMCIA Ethernet card under Windows 2000 (with the latest SP at the time) which demonstrated the vulnerability (among other Ethernet cards which have demonstrated the vulnerability under Microsoft Windows 2000). It is clear to us that device drivers under the various Microsoft operating systems are vulnerable. Microsoft's statement to CERT: "Microsoft does not ship any drivers that contain the vulnerability. However, we have found samples in our documentation that, when compiled without alteration, could yield a driver that could contain this issue. We have made corrections to the samples in our documentation, and will include tests for this issue in our certification process." If you read the statement carefully you can understand that there are OTHER manufactures which have built device drivers for their networking equipment that are based on Microsoft's documentation and therefore MIGHT BE VULNERABLE. Microsoft does not make vulnerable device drivers BUT Microsoft's sample code was vulnerable and therefore Microsoft has added a test to the device driver's certification test which will test for the bug. The situation is that CURRENT Microsoft certified device drivers MIGHT BE VULNERABLE. Different vendors were contacted by CERT more than 6 months ago and had an enormous amount of time to fix this issue before it went public. The authors did not receive a list of vendors who were notified by CERT. The authors were aware that Microsoft was one of the vendors who were contacted and notified regarding this vulnerability. The examples in the paper are given from the Linux operating system because it helps to illustrate the problem. Why this vulnerability is so wide spread? ----------------------------------------- Some networking gear manufactures choose to purchase (in some cases) chipsets from a chipset manufacture rather then developing their own (or using their own). Therefore you might find networking cards from one vendor with chipsets of another chipset manufacture (for example some low-end SMC cards are using RealTek chipsets). Some other manufactures are embedding networking cards with their products (such as motherboards with LAN). To minimize the cost, sometimes, low-end chipsets, which many of whom have vulnerable device drivers on different operating system, are used (some vulnerable device drivers are even shipped with some cards...). How can you test your network card and device driver? ----------------------------------------------------- You need to send packets which are less than 46 data bytes long (the minimum packet size) to examine if you experience this vulnerability with your Ethernet card and device driver. Any packet less than 46 data bytes long would do the trick but we have found the following examples helpful: - An ICMP Echo request packet with 1 data byte in its payload (total of 29 bytes). The rest - 17 data bytes will be filled with information (you can see for yourself in the paper we have written what kind of information it will be) if your Ethernet card's device driver is vulnerable. - You can also use Raw Packets and then have 28 data bytes as room for padded data. Why is this better then a sniffer? or Why is this bug important? ---------------------------------------------------------------- First Example: You can extract information that you will never be able to see on a switched environment. A Second Exmaple: In some cases you will be able to extract information directly from a Router on your LAN (try this with a Linux or a NetBSD machine acting as a router with vulnerable Ethernet cards (and their device drivers) and see for yourself how easily information is being gleaned) or from another networking equipment on your LAN. A Third Example: Another example might be a corporate network (just think about the scenario of a nice flat switched network). There are special instances were the padded information might cross layer 2 boundaries, but they are very unique in nature and depend on many factors. Combining the information is not a trivial task for script kiddies. If you are experienced with networking and seen and analyzed network traffic in the past you will be able to understand what are the portions of information you are absorbing (see the examples in the paper). In our tests we were able to extract pop3 passwords, other clear text passwords, cookies, and other interesting pieces of information. We hope this email will help the community and more people to understand why this bug class is important and problematic. We urge people to read the paper before they cry wolf... Yours, Ofir Arkin [ofir(a)sys-security.com] Founder The Sys-Security Group http://www.sys-security.com PGP CC2C BE53 12C6 C9F2 87B1 B8C6 0DFA CF2D D360 43FA

1 0

No LCD, and Agenda : Can we add..
by jitendras＠vsnl.com 13 Jan '03

13 Jan '03

Dear Amish 1> Plaese note we could not arrange for an LCD . But we have many PCs on LAN. Linux 7.2. 2> Can we add to the agenda: GUNIFY meet : How to involve colleges Jitendra

3 2

← Newer
1
...
9
10
11
12
13
14
15
...
20
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Linuxers January 2003