Your message dated Tue, 06 Apr 2010 17:21:29 +0000
with message-id <[email protected]>
and subject line Bug#576680: fixed in rkhunter 1.3.6-4
has caused the Debian Bug report #576680,
regarding rkhunter: Fix false positive Xzibit rootkit detection
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
576680: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=576680
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: rkhunter
Version: 1.3.6-3
Severity: normal
Tags: patch
User: [email protected]
Usertags: origin-ubuntu lucid ubuntu-patch
*** /tmp/tmpxR3xQ8
In Ubuntu, we've applied the attached patch to achieve the following:
* debian/patches/20_fix_strings_check.diff: fix hdparm false alert which
leads to the Xzibit rootkit incorrectly being detected. The patch
now ignores comment lines when performing string checks. (LP: #556455)
We thought you might be interested in doing the same.
-- System Information:
Debian Release: squeeze/sid
APT prefers lucid-updates
APT policy: (500, 'lucid-updates'), (500, 'lucid-security'), (500, 'lucid')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-19-generic (SMP w/2 CPU cores)
Locale: LANG=en_CA.utf8, LC_CTYPE=en_CA.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
diff -Nru rkhunter-1.3.6/debian/changelog rkhunter-1.3.6/debian/changelog
diff -Nru rkhunter-1.3.6/debian/patches/20_fix_strings_check.diff rkhunter-1.3.6/debian/patches/20_fix_strings_check.diff
--- rkhunter-1.3.6/debian/patches/20_fix_strings_check.diff 1969-12-31 19:00:00.000000000 -0500
+++ rkhunter-1.3.6/debian/patches/20_fix_strings_check.diff 2010-04-06 08:45:07.000000000 -0400
@@ -0,0 +1,17 @@
+Description: fix hdparm false alert
+Bug: http://sourceforge.net/tracker/?func=detail&aid=2951178&group_id=155034&atid=794187
+Origin: upstream, http://rkhunter.cvs.sourceforge.net/viewvc/rkhunter/rkhunter/files/rkhunter?r1=1.310&r2=1.311
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/rkhunter/+bug/556455
+
+diff -Nur rkhunter-1.3.6/files/rkhunter rkhunter-1.3.6.new/files/rkhunter
+--- rkhunter-1.3.6/files/rkhunter 2009-11-29 08:05:09.000000000 -0500
++++ rkhunter-1.3.6.new/files/rkhunter 2010-04-06 08:39:13.000000000 -0400
+@@ -9392,7 +9405,7 @@
+ FOUNDFILE=1
+
+ for FNAME in ${RC_PATHS}; do
+- FOUNDSTRING=`${STRINGS_CMD} -n 3 ${FNAME} | grep "${STRING}"`
++ FOUNDSTRING=`${STRINGS_CMD} -n 3 ${FNAME} | grep -v '^#' | grep "${STRING}"`
+
+ if [ -n "${FOUNDSTRING}" ]; then
+ RKHTMPVAR2=`echo "${FNAME}" | sed -e 's/\./\\\./g'`
diff -Nru rkhunter-1.3.6/debian/patches/series rkhunter-1.3.6/debian/patches/series
--- rkhunter-1.3.6/debian/patches/series 2009-12-11 12:01:34.000000000 -0500
+++ rkhunter-1.3.6/debian/patches/series 2010-04-06 08:43:40.000000000 -0400
@@ -1,3 +1,4 @@
05_custom_conffile.diff
10_fix-man.diff
15_remove-empty-dir.diff
+20_fix_strings_check.diff
--- End Message ---
--- Begin Message ---
Source: rkhunter
Source-Version: 1.3.6-4
We believe that the bug you reported is fixed in the latest version of
rkhunter, which is due to be installed in the Debian FTP archive:
rkhunter_1.3.6-4.debian.tar.gz
to main/r/rkhunter/rkhunter_1.3.6-4.debian.tar.gz
rkhunter_1.3.6-4.dsc
to main/r/rkhunter/rkhunter_1.3.6-4.dsc
rkhunter_1.3.6-4_all.deb
to main/r/rkhunter/rkhunter_1.3.6-4_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Julien Valroff <[email protected]> (supplier of updated rkhunter package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 06 Apr 2010 18:07:53 +0200
Source: rkhunter
Binary: rkhunter
Architecture: source all
Version: 1.3.6-4
Distribution: unstable
Urgency: low
Maintainer: Julien Valroff <[email protected]>
Changed-By: Julien Valroff <[email protected]>
Description:
rkhunter - rootkit, backdoor, sniffer and exploit scanner
Closes: 576680
Changes:
rkhunter (1.3.6-4) unstable; urgency=low
.
* Bump Debian policy version to 3.8.4
* Remove Micah from Uploaders
* Switch GIT repository: updated VCS field accordingly
* Apply patch kindly sent by Marc Deslauriers to fix
some of the false positives in the Xzibit rootkit
detection (Closes: #576680)
* Update note in README.Debian to only state remaining files
Checksums-Sha1:
7bf218be8be4f6df24aba695eb9951d9d4004eea 1168 rkhunter_1.3.6-4.dsc
7accb19dcfecb64b83c9b836cffb69cd65b0cdf4 25874 rkhunter_1.3.6-4.debian.tar.gz
0859b93dde907ce975cfa44dfe4a6795482cbbb4 221944 rkhunter_1.3.6-4_all.deb
Checksums-Sha256:
e811e04947bdc551752403fbee944345a42fcf02053bdfde19aaf5a0e134b6c3 1168
rkhunter_1.3.6-4.dsc
85fee6d4f6b128b2b6b13b215e0b274d194894e34834e9b3f6fe77e4ea8258b8 25874
rkhunter_1.3.6-4.debian.tar.gz
58fbcab87e528b540fd47d9f98f2d5f62465307e03b8d71b7cf14d939a6f4adc 221944
rkhunter_1.3.6-4_all.deb
Files:
4d41dc6fcf44b5fb281c8d4f41969fda 1168 admin optional rkhunter_1.3.6-4.dsc
7c8474b00e5f3b67d41e4d6f55c110f3 25874 admin optional
rkhunter_1.3.6-4.debian.tar.gz
cc7cd071ccb2f178f1d50c50b8cbdc34 221944 admin optional rkhunter_1.3.6-4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAku7Y4EACgkQIQvyq59x1EkEDACfSVY5kAgIayEy0RqDX4L3QIo0
PesAoKMNBw3m1TY9VpEwNOAv+tm/8QGU
=fv9p
-----END PGP SIGNATURE-----
--- End Message ---
