Linuxers

linuxers@mm.ilug-bom.org.in

14152 discussions

SOS: smtp and pop authentication
by Gurpreet Singh 04 Feb '03

04 Feb '03

hi all i am writing a SMTP and POP mail client for a s/w presentation comptt. am coding in Java can someone tell me how am i suppose to authenticate to the SMTP and POP servers. i mean what command is needed to be sent to the servers to authenticate myself as a valid user?? am using smtp.rediffmail.com and pop.rediffmail.com for testing need help very soon plz regards gurpreet Gurpreet Singh Student Final Yr Computer Sc. & Engg. --------------------------------------------------------------------- M A K E Y O U R O W N R O A D --------------------------------------------------------------------

5 4

[Fwd: Preventing exploitation with rebasing] << Fundu...:)
by Trevor Warren 04 Feb '03

04 Feb '03

-----Forwarded Message----- From: David Litchfield <david(a)ngssoftware.com> To: bugtraq(a)securityfocus.com, ntbugtraq(a)listserv.ntbugtraq.com, vulnwatch(a)vulnwatch.org Subject: Preventing exploitation with rebasing Date: 03 Feb 2003 21:08:35 -0800 Defeating Exploits ************** The ideas in this "paper" present a method for defeating exploits; not the actual vulnerability. Before getting to the details let's consider slammer (again). What made slammer so successful? The overriding factor that made slammer so successful was it's ability to spread. What made it's spread a foregone conclusion was the fact that every vulnerable SQL Server/MSDE had a "jmp esp" instruction at address 0x42B0C9DC. This was the address that was used to gain control of the SQL Server's path of execution to a point where the worm's payload, the "arbitrary code", would be executed. This address is in a dynamic link library (DLL) , sqlsort.dll which has an "image base" of 0x42AE0000. Every image file, DLL or executable, has an "Image Base" and this base is the preferred location where the file should be loaded into memory by the Windows Loader. [I don't want to digress, here, as to what happens if there's a conflict. See the references at the end.] Now if this Image Base on one particular system had been 0x42AF0000 then the worm would have failed to infect this particular box; the "jmp esp" instruction that should've been at 0x42B0C9DC on this system would be found at 0x42B1C9DC so the worm would have been off target. The SQL Server running on this system, whilst still being "vulnerable" to the buffer overflow vulnerability would have been invulnerable to this worm. Sure - the SQL Server may have crashed - but it would not have been compromised. It's like sickle cell. Someone born with the gene that causes sickle cell anaemia, a blood disorder that affects many people of a West African origin, or carriers of the gene, sickle cell trait, do not suffer from the ill affects of malaria, a disease caused by a parasite and most commonly spread by mosquitoes. Whilst someone with sickle cell trait can still catch malaria, the gene mutates the haemoglobin in their blood in such a way that they are invulnerable to the debilitating side effects and syptoms of the disease such as mental confusion, coma and death. There is an obvious evolutionary advantage to sickle cell trait; remember that the evolution of the species cares not about how long a person lives, only that they live long enough to pass on their genes. (Those with anaemia may suffer from crises, periods of acute pain so the trade off is somewhat questionable.) In areas where malaria is a common cause of death, being a carrier of the sick cell gene can help ensure that this person lives long enough to have progeny. This is Darwinian natural selection in progress. Rebasing ******* The problem with operating systems is that they all have pretty much the same "genetic code" which makes each and every one of them vulnerable to a new exploit. So we need to make them different and this can be achieved through rebasing. Rebasing is the process of changing the Image Base of an image file. By doing this the DLL/EXE is loaded into a different location in the virtual address space. Going back to Slammer, had I have rebased sqlsort.dll giving it a new base of 0x41410000 my box would have been invulnerable to the worm. If another worm were written, though, that used an address that contained a "jmp esp" instruction in kernel32.dll then I would be vulnerable. So I rebase kernel32.dll. But then another worm uses another DLL so I rebase that one, too. Eventually I've rebased all of the DLLs used by SQL Server mutating it's "genetic code", making it considerably different to any other SQL Server install on the planet. In fact if I rebase every DLL on my system and every executable then I can make my box almost invulnerable to a given exploit, past, present or future. It's not that my box is invulnerable to a buffer overflow vulnerability - it's just invulnerable to the exploits for it. To gain control of a system protected in such a way would require that the author of the exploit know the location of loaded DLLs. So how easy is it to rebase DLLs and executables? Very. Microsoft have provided a function to do this, ReBaseImage(), exported by imagehlp.dll. If you rebase an image the new base must be on a 64K boundary - i.e. if the image base mod 64000 !=0 the base is not valid. The only other problem is Windows File Protection. Once you've rebased a copy of the DLL you need to copy the new DLL over the old one but Windows File Protection won't allow you to do this. To get around the problem use the MoveFileEx and specifying the MOVEFILE_DELAY_UNTIL_REBOOT flag. Doing this will add a registry value, "PendingFileRenameOperations" to HKLM\System\CurrentControlSet\Control\Session Manager\. You then need to add another DWORD value "AllowProtectedRenames" and set it to 1. Then restart the system. On reboot the new DLLs, with their new image bases, will be loaded. For example - here is sample output of listdlls after kernel32.dll and ws2_32.dll have been rebased. Copyright (C) 1997-2000 Mark Russinovich http://www.sysinternals.com ---------------------------------------------------------------------------- -- WINLOGON.EXE pid: 208 Command line: winlogon.exe Base Size Version Path 0x01000000 0x2e000 \??\C:\WINNT\system32\winlogon.exe 0x77f80000 0x7b000 5.00.2195.5400 C:\WINNT\System32\ntdll.dll 0x78000000 0x46000 6.01.9359.0000 C:\WINNT\system32\MSVCRT.dll 0x4a4a0000 0xb1000 5.00.2195.6011 C:\WINNT\system32\KERNEL32.dll 0x77db0000 0x5b000 5.00.2195.5992 C:\WINNT\system32\ADVAPI32.dll 0x77d30000 0x71000 5.00.2195.5419 C:\WINNT\system32\RPCRT4.dll 0x54530000 0x13000 5.00.2195.4874 C:\WINNT\system32\WS2_32.dll .. .. Now all the way through this I've been saying things like "almost invulnerable" etc. Here's the reason. For some vulnerabilities it may be sufficient to overwrite a saved return address, function pointer or whatever by only a few bytes. For example assume a saved return address is 0x44784500 and at address 0x44784536 is a "jmp ebx" instruction and ebx points to our code. Then we only need to overwrite the saved return address by 1 byte - with 0x36. So knowledge of the DLL load address is not needed. However, this scenario is going to happen so infrequently (if ever) that it does not detract from the idea of rebasing your system. There may other ways to bypass this method. Some ideas to further help prevent exploits from working. Use addresses such as 0x**000000 or 0x00**0000 for the new image base. With there being a NULL in much of the image's address space this will help. (This of course won't make a difference with unicode overflows) Ensure at least one (core) DLL has a base of 0x00119400 . This will ensure that a common stack location 0x00120000 has been assigned forcing the OS to chose another location for the stack. You get the idea. Feel free to mail me/lists with comments. Cheers, David Litchfield NGSSoftware Ltd http://www.ngssoftware.com/ MSDN Info ReBaseImage() http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/ rebaseimage.asp MoveFileEx() http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base /movefileex.asp

2 1

>> help needed if possible <<
by Trevor Warren 04 Feb '03

04 Feb '03

Hello Mr. Shastri, good-morning. Thanks for writing in. In fact i had been speaking to Prakash Advani Yesterday and he told me about what you are into and that i could try asking you for some help. Also cause as of now we have recieved a single donation which means we go empty handed to these State Level events. Before going on with my sales pitch i would like you to know the reason behind our efforts........ As part of the Gnu-Linux users group of bombay we volunteer from time to time for various conferences/seminars/Workshops we hold across the country. We are always open towards Educating the Industry/Academia/Student Fraternity about their options in the Free Software-Open Source World vis-a-viv the Close Source World. In this context for two of the upcoming Conferences at Shivaji University and Symbiosis Institute Pune we are looking forwards to helping students educate themselves by retailing A Gnu-Linux Starters Kit for 20-25/-. This cost is purely to cover the cost of the cd's and we will make it a point to reimburse you what ever may the returns may be. The starter kit will consist of ....... --> Knoppix latest cd --> TLDP.org ( Entire Howto's ) --> A Printout on all the important links useful to a gnu-bie. Lemme know Mr. Shastri if you would be glad to help us spread knowledge among the upcoming generation of our country and empowering them with values that will see us in good stead. We value your support and are looking forwards to the same. Please feel free to contact me on 9820349221(M) and mail me your numbers in case you want me to do so. Last but not the least.....we are looking forwards towards conducting Major Workshops for Hardware Vendors in Bombay. Let us know if you would be interested in having the same planned. Have a nice day Mr. Shastri and looking forwards to a positive response from your end. Trevor On Mon, 2003-02-03 at 23:11, jayaram shastri wrote: > How many CDs required and which. kindly inform > > shastri

1 0

Help
by OSP 04 Feb '03

04 Feb '03

Hi A,ll, We are using Postgres as a database server.We ahave some backend functions which are used for triggers. We frequently get following error since the trigger fails to execute. Error: fmgr info: Cache lookup failed function 'some number'(e.g 5009879). Please guide us, Thanking in Advance, OSP

2 1

email servers at multiple locations- same domain name
by Ashok Iyer 04 Feb '03

04 Feb '03

Hi, I have the following setup. I have a client who has 10 offices across Mumbai. Each office has approximately 50 people on the LAN. All offices have a linux server that connects to a central office RAS via dial up. LAN users can then access servers located at the central office for nightly database updates etc.. All IPs used are RFC 1918 non-routable type. I want to install mail services for the client. A mail server will be placed at the central location. This mail server will be connected to the internet and receive all mails destined for the organisation - say fooabc.org. There will be mail servers at each branch office also which will handle intraoffice mail - i.e. mails within a single office. I want to know if we can use the same domain name say fooabc.org at each branch location. Essentially, when each branch mail server receives a mail for userA(a)fooabc.org, it should look up a table(or whatever) to find out if userA exists locally in that branch office. If userA exists then it should keep the mail locally. In case userA is at some other location, then the mail should be forwarded to the central mail server. I have a faint idea that LOTUS DOMINO does something like this. I want to do this setup with qmail, I am pretty conversant with qmail and have a few installations also. Can this be done? If not, then how can the same be achieved? Please suggest. Regards, Ashok

2 1

Re: [ILUG-BOM] [OFF TOPIC] AI Seminar: Indian Language wordnets (verification)
by Sameer D. Sahasrabuddhe 04 Feb '03

04 Feb '03

On Sun, Feb 02, 2003 at 11:31:31AM -0800, Rishi wrote: > I'm protecting myself from receiving junk mail. > Just this once, click the link below so I can receive your emails. You won't > have to do this again. http://spamarrest.com/a?50440004:743122 Whatever service you are using, please set it so that it does not respond to mailing lists that you subscribe to. Do you really expect all the people on these lists to let your service know that our mails are not spam? Sameer. -- You will obey or molten silver will be poured into your ears.

2 1

Regarding Y'day's meet
by Aswin Bhupalam 04 Feb '03

04 Feb '03

Hello e-body, I couldn't attend the yesterday's meet at ruparel due to some reasons. Can any of u briefly mail me abt the discussions held there, abt RMS visit, Gnunify in particular. Thanks, #win

1 0

Fund Raising for RMS Visit
by Nagarjuna G. 04 Feb '03

04 Feb '03

Some of you who came to the meeting yesterday would know the requirements already. We need to raise about Rs.20,000/- as soon as possible. This money will be spent in supporting RMS's travel from Delhi to Mumbai, and expenses at VJTI public meeting, for posters, brochures etc. In the yesterday's meeting we already got Rs.2480/-. Please come forward to donate in Rs.50, 100. 500. 1000 etc. Money should reach me as soon as possible so that arrangements can be done prior to his arrival so that when he is around we only concentrate on the events and not on this mundane matters. Netcore has agreed to take care of transport and boarding. Lodging I think will be arranged in IIT guest house. For collecting money and handing over to me, some of you may have to act as nodes. Please announce your name and phone numbers so that those who wish to donate could reach easily. Nagarjuna

3 2

Virtual Linux
by Manish Jethani 03 Feb '03

03 Feb '03

Has anybody tried Virtual Linux? http://www.virtual-linux.org/ Let's have some feedback. Seems to be a very interesting project. Finally, Ramnikbhai can try out linux without having to "touch" his Existing Setup (TM). Manish -- "The statements and opinions expressed here are my own and do not necessarily represent those of Oracle Corporation." Manish Jethani phone (work) +91 80 51073488 Member Technical Staff manish.jethani(a)oracle.com Oracle (India) Visit my personal home page: http://www.geocities.com/manish_jethani/

4 7

[OT] fixing the line length
by Manish Jethani 03 Feb '03

03 Feb '03

Sometime back we had a discussion (poll?) on "fixing the line length" in our posts. Some, like myself, were of the opinion that the sender should wrap the text at an "appropriate" column, say, 66. Some others were arguing that this scheme only screws up the display. I just discovered this RFC [http://www.ietf.org/rfc/rfc2646.txt] (have I been living in a cave?) that addresses this issue by introducing a new parameter with the text/plain type. It's "format=flowed|fixed". And guess what - Mozilla already supports it, Mutt is introducing it in 1.3, and Pine developers are thinking about it (I might be wrong, but that's what a recent message on the Pine mailing list suggests). So I hope this will solve the issue. Manish -- "The statements and opinions expressed here are my own and do not necessarily represent those of Oracle Corporation." Manish Jethani phone (work) +91 80 51073488 Member Technical Staff manish.jethani(a)oracle.com Oracle (India) Visit my personal home page: http://www.geocities.com/manish_jethani/

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

2001

Linuxers