OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Vuln-Dev Archives: Re: leaky kernel ? ;)

Re: leaky kernel ? ;)


Subject: Re: leaky kernel ? ;)
From: Wakko Ellington Warner-Warner III (wakkoWTOWER.COM)
Date: Thu Dec 30 1999 - 02:09:12 CST


On Wed, 29 Dec 1999, mIV wrote:

> OK, there's RH 6.1 on 2.2.13. Let's take a look at /var/log/messages:
>
> and so on ... Do you know where are these strings from ? I'll tell ya.
> It's all from my mail fetched by fetchmail (via PPP). OK, these were
> strings but we have also sth like this:
>
> Dec 13 22:24:38 pentium kernel: 40 21 4C BB F4 6F 5F DD !L..o_.
> Dec 13 22:24:39 pentium kernel: C4 41 74 3F BD 54 47 B9 .At?.TG.
>
> That's not good when some net packets are dumped to system logs, is it ?
> Is it a bug ? If so, is it known to kernel developers ?

Check your pppd options. From the pppd(8) manpage:

       debug Enables connection debugging facilities. If this
              option is given, pppd will log the contents of all
              control packets sent or received in a readable
              form. The packets are logged through syslog with
              facility daemon and level debug. This information
              can be directed to a file by setting up
              /etc/syslog.conf appropriately (see sys-
              log.conf(5)).

and, probably what you've got enabled somewhere:

       kdebug n
              Enable debugging code in the kernel-level PPP
              driver. The argument n is a number which is the
              sum of the following values: 1 to enable general
              debug messages, 2 to request that the contents of
              received packets be printed, and 4 to request that
              the contents of transmitted packets be printed. On
              most systems, messages printed by the kernel are
              logged by syslog(1) to a file as directed in the
              /etc/syslog.conf configuration file.

HTH.

- A.P.

--

+--------------------------------+------------------+ | "It's possible, you can never | NIC: AP5514 17 | | know, that the universe exists | http://bitey.net | | only for me." - Bill Gates | wakkobitey.net | +--------------------------------+------------------+



This archive was generated by hypermail 2b27 : Thu Dec 30 1999 - 10:38:29 CST