Your message dated Wed, 07 Jan 2009 18:32:03 +0000
with message-id <[email protected]>
and subject line Bug#498062: fixed in chkrootkit 0.48-9
has caused the Debian Bug report #498062,
regarding chkrootkit: -e option should work for rootkit files
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
498062: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498062
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: chkrootkit
Version: 0.48-5
Severity: normal
The -e option doesn't work as documented, since it doesn't apply to
files associated with specific rootkits. Attached is a patch showing
one way of fixing this. There are two caveats:
1) It applies only to the RH-Sharpe rootkit check. That's enough to
show the method, and enables me to use "-e /usr/bin/slice" to
eliminate the false positive with the slice package. However, the
author may have a better method.
2) My space delimited list of filenames doesn't allow for filenames
with whitespace (e.g. the directory "/usr/doc/... " in the ark
rootkit).
Note that my method also addresses #126160, since the rootkit
filenames are written out.
- Jim Van Zandt
-- System Information:
Debian Release: lenny/sid
APT prefers unstable
APT policy: (990, 'unstable'), (500, 'oldstable'), (500, 'testing'), (500,
'stable')
Architecture: i386 (i686)
Kernel: Linux 2.6.25 (SMP w/4 CPU cores; PREEMPT)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/bash
Versions of packages chkrootkit depends on:
ii binutils 2.18.1~cvs20080103-7 The GNU assembler, linker and bina
ii debconf [debconf-2. 1.5.23 Debian configuration management sy
ii libc6 2.7-13 GNU C Library: Shared libraries
ii net-tools 1.60-19 The NET-3 networking toolkit
ii procps 1:3.2.7-9 /proc file system utilities
chkrootkit recommends no packages.
chkrootkit suggests no packages.
-- debconf information:
* chkrootkit/run_daily: true
* chkrootkit/run_daily_opts: -q
* chkrootkit/diff_mode: false
--- chkrootkit-old 2008-09-05 22:22:36.000000000 -0400
+++ chkrootkit 2008-09-06 13:46:20.000000000 -0400
@@ -697,20 +697,42 @@
fi
### RH-Sharpe rootkit
+
+lookfor_rootkit() {
+ rkname=$1; files=$2; dirs=$3; # file/directory names cannot have whitespace
if [ "${QUIET}" != "t" ]; then \
- printn "Searching for RH-Sharpe's default files... "; fi
+ printn "Searching for rootkit $rkname default files... "; fi
- if [ -r "${ROOTDIR}bin/lps" -o -r "${ROOTDIR}usr/bin/lpstree" \
--o -r "${ROOTDIR}usr/bin/ltop" -o -r "${ROOTDIR}usr/bin/lkillall" \
--o -r "${ROOTDIR}usr/bin/ldu" -o -r "${ROOTDIR}usr/bin/lnetstat" \
--o -r "${ROOTDIR}usr/bin/wp" -o -r "${ROOTDIR}usr/bin/shad" \
--o -r "${ROOTDIR}usr/bin/vadim" -o -r "${ROOTDIR}usr/bin/slice" \
--o -r "${ROOTDIR}usr/bin/cleaner" -o -r "${ROOTDIR}usr/include/rpcsvc/du" ]
- then
- echo "Possible RH-Sharpe's rootkit installed"
+ bad="";
+ for f in $files ; do
+ if [ -r ${ROOTDIR}${f} ]; then
+ for exclude in $EXCLUDES; do
+ if [ /${f} = $exclude ]; then continue 2; fi
+ done
+ bad="$bad $f";
+ fi
+ done
+ for d in $dirs ; do
+ if [ -d ${ROOTDIR}${d} ]; then
+ for exclude in $EXCLUDES; do
+ if [ /${d} = $exclude ]; then continue 2; fi
+ done
+ bad="$bad $d";
+ fi
+ done
+ if [ "$bad" != "" ]; then
+ echo "Possible $rkname rootkit installed:"
+ echo "$bad"
else
- if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi
+ if [ "${QUIET}" != "t" ]; then echo "nothing found"; fi
fi
+}
+
+ lookfor_rootkit "RH-Sharpe's" "bin/lps usr/bin/lpstree \
+ usr/bin/ltop usr/bin/lkillall usr/bin/ldu \
+ usr/bin/lnetstat usr/bin/wp usr/bin/shad \
+ usr/bin/vadim usr/bin/slice usr/bin/cleaner \
+ usr/include/rpcsvc/du" ""
### ark rootkit
if [ "${QUIET}" != "t" ]; then printn \
--- End Message ---
--- Begin Message ---
Source: chkrootkit
Source-Version: 0.48-9
We believe that the bug you reported is fixed in the latest version of
chkrootkit, which is due to be installed in the Debian FTP archive:
chkrootkit_0.48-9.diff.gz
to pool/main/c/chkrootkit/chkrootkit_0.48-9.diff.gz
chkrootkit_0.48-9.dsc
to pool/main/c/chkrootkit/chkrootkit_0.48-9.dsc
chkrootkit_0.48-9_i386.deb
to pool/main/c/chkrootkit/chkrootkit_0.48-9_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Giuseppe Iuculano <[email protected]> (supplier of updated chkrootkit
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Wed, 07 Jan 2009 19:14:36 +0100
Source: chkrootkit
Binary: chkrootkit
Architecture: source i386
Version: 0.48-9
Distribution: unstable
Urgency: low
Maintainer: Giuseppe Iuculano <[email protected]>
Changed-By: Giuseppe Iuculano <[email protected]>
Description:
chkrootkit - rootkit detector
Closes: 126160 286735 445955 498062 507753
Changes:
chkrootkit (0.48-9) unstable; urgency=low
.
* [5e5e86d] Updated Spanish debconf translation, thanks to Francisco
Javier Cuadrado (Closes: #507753)
* [bda385f] Switch to quilt
* [730645f] debian/README.source: Updated with quilt info
* [4f11213] debian/patches/excludes.patch: extend -e options also for
files associated with specific rootkits (Closes: #498062) and write
rootkit filenames (Closes: #126160), thanks to James R. Van Zandt.
* [fe81414] debian/cron.daily: Warns about the change until the user
acknowledges the change. (Closes: #286735, #445955) Thanks to
Richard Lewis
* [d22dd97] Use /var/log/chkrootkit as log dir instead of
/var/cache/chkrootkit, and remove it on purge
Checksums-Sha1:
f25b4e5c459d7b0fb25f9199a7fa4f713b861835 1237 chkrootkit_0.48-9.dsc
e77f6622fade2bcb5fdd7069e9b1f518a1fb616d 32911 chkrootkit_0.48-9.diff.gz
274fb7f49292e99ee2bbdfbbfe29e8105503e890 294096 chkrootkit_0.48-9_i386.deb
Checksums-Sha256:
dcf35cab41a10cc235d79a469b9008e14753c6ad799e3bbbbb3d53f809f110ff 1237
chkrootkit_0.48-9.dsc
8d6c8f1a67b6a2158c0cbf1b65362fc06c32ec9dab90c0a1dfedb879a692b8d4 32911
chkrootkit_0.48-9.diff.gz
ca7451d3ed268d8c80bd416dcbf7f5804552a2f2435ced3486e213148b801c31 294096
chkrootkit_0.48-9_i386.deb
Files:
9bf3764dd4b8c9d6e40dafa582e3dac3 1237 misc optional chkrootkit_0.48-9.dsc
7a6992c123359a6e8c744ab3ef171d3c 32911 misc optional chkrootkit_0.48-9.diff.gz
3f4be2a6e01fdaa0ed7c37c0ed6e5ec0 294096 misc optional
chkrootkit_0.48-9_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAklk83sACgkQNxpp46476aqogQCeJ5iyDJeUvQHZ1b+YJ//CemO2
LSYAn2U9qpbFukbZi74kDVoG7Na8oZPZ
=l+GJ
-----END PGP SIGNATURE-----
--- End Message ---
