Your message dated Thu, 24 Nov 2005 15:02:08 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#306784: fixed in chkrootkit 0.46a-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 28 Apr 2005 14:08:45 +0000
>From [EMAIL PROTECTED] Thu Apr 28 07:08:45 2005
Return-path: <[EMAIL PROTECTED]>
Received: from fungible.com (lobus.fungible.com) [64.161.114.2]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DR9h7-0004lh-00; Thu, 28 Apr 2005 07:08:45 -0700
Received: from lobus.fungible.com (localhost [127.0.0.1])
by lobus.fungible.com (8.13.4/8.13.4/Debian-1) with ESMTP id
j3SE8ie5021280
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT)
for <[EMAIL PROTECTED]>; Thu, 28 Apr 2005 07:08:44 -0700
Received: (from [EMAIL PROTECTED])
by lobus.fungible.com (8.13.4/8.13.4/Submit) id j3SE8id1021278;
Thu, 28 Apr 2005 07:08:44 -0700
Message-Id: <[EMAIL PROTECTED]>
X-Authentication-Warning: lobus.fungible.com: tim set sender to [EMAIL
PROTECTED] using -f
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Tim Freeman <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: chkrootkit: False positive if mindi is installed
X-Mailer: reportbug 3.8
Date: Thu, 28 Apr 2005 07:08:44 -0700
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: chkrootkit
Version: 0.44-2
Severity: normal
chkrootkit gives this output on my system:
lobus:~# chkrootkit
ROOTDIR is `/'
Checking `amd'... not found
>>>Boring stuff omitted<<<
Searching for Ambient's rootkit (ark) default files and dirs... nothing
found
Searching for suspicious files and dirs, it may take a while...
/usr/lib/mindi/rootfs/proc/.keep /usr/lib/mindi/rootfs/root/.profile
Searching for LPD Worm files and dirs... nothing found
>>>More boring stuff omitted<<<
Checking `z2'... nothing deleted
lobus:~#
The two files
/usr/lib/mindi/rootfs/proc/.keep /usr/lib/mindi/rootfs/root/.profile
are from mindi:
lobus:~# dpkg -S /usr/lib/mindi/rootfs/proc/.keep
mindi: /usr/lib/mindi/rootfs/proc/.keep
lobus:~# dpkg -S /usr/lib/mindi/rootfs/root/.profile
mindi: /usr/lib/mindi/rootfs/root/.profile
lobus:~# dpkg -l mindi
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-files/Unpacked/Failed-config/Half-installed
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err:
uppercase=bad)
||/ Name Version Description
+++-==============-==============-============================================
ii mindi 1.04-4 creates boot/root disks based on your
system
lobus:~#
-- System Information:
Debian Release: 3.1
APT prefers testing
APT policy: (1500, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.4.26-treo
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages chkrootkit depends on:
ii binutils 2.15-5 The GNU assembler, linker and bina
ii debconf 1.4.30.13 Debian configuration management sy
ii libc6 2.3.2.ds1-20 GNU C Library: Shared libraries an
ii net-tools 1.60-10 The NET-3 networking toolkit
-- debconf information:
* chkrootkit/run_daily: true
* chkrootkit/run_daily_opts:
---------------------------------------
Received: (at 306784-close) by bugs.debian.org; 24 Nov 2005 23:11:34 +0000
>From [EMAIL PROTECTED] Thu Nov 24 15:11:34 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 4.50)
id 1EfQ6S-0002Qs-U1; Thu, 24 Nov 2005 15:02:08 -0800
From: lantz moore <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#306784: fixed in chkrootkit 0.46a-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Thu, 24 Nov 2005 15:02:08 -0800
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Source: chkrootkit
Source-Version: 0.46a-1
We believe that the bug you reported is fixed in the latest version of
chkrootkit, which is due to be installed in the Debian FTP archive:
chkrootkit_0.46a-1.diff.gz
to pool/main/c/chkrootkit/chkrootkit_0.46a-1.diff.gz
chkrootkit_0.46a-1.dsc
to pool/main/c/chkrootkit/chkrootkit_0.46a-1.dsc
chkrootkit_0.46a-1_i386.deb
to pool/main/c/chkrootkit/chkrootkit_0.46a-1_i386.deb
chkrootkit_0.46a.orig.tar.gz
to pool/main/c/chkrootkit/chkrootkit_0.46a.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
lantz moore <[EMAIL PROTECTED]> (supplier of updated chkrootkit package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Thu, 24 Nov 2005 13:17:21 -0800
Source: chkrootkit
Binary: chkrootkit
Architecture: source i386
Version: 0.46a-1
Distribution: unstable
Urgency: low
Maintainer: lantz moore <[EMAIL PROTECTED]>
Changed-By: lantz moore <[EMAIL PROTECTED]>
Description:
chkrootkit - Checks for signs of rootkits on the local system
Closes: 297680 306263 306648 306784 307349 309386 309387 309942 310029 311107
313250 316610 318873 323191 326139 331777 333487 333710 334394 337943 337962
Changes:
chkrootkit (0.46a-1) unstable; urgency=low
.
* New upstream release (closes: 337943)
* added findargs to the 'shell history anomalies' test (closes: 297680)
* added quieting capability to chklastlog (closes: 306263)
* the wted test was running even when no wtmp file was found, fixed (see:
306449)
* added note to README.FALSE-POSITIVE
- mindi has hidden files (closes: 306784)
- erlang-base's epmd listens on a bindshell port (closes: 309386)
- perl has .packlist files (closes: 309387)
- realplay has .realplayerrc (closes: 309942)
- smlnj has .{cm,run,heap} files (closes: 323191)
- gnustep-make has .GNUsteprc (closes: 337962)
- pipsecd listens on a scalper port (closes: 307349)
* added optional depends debconf-2.0 (closes: 331777)
* added debconf translations (closes:
310029,326139,306648,311107,313250,333487,318873,334394)
* output suspicious files on separate lines (closes: 316610)
* added dependency on procps (closes: 333710)
Files:
ba67ee18f030545be5893e056395bdc3 605 misc optional chkrootkit_0.46a-1.dsc
1302d9b19f47da62bf45714ab376e2cc 36609 misc optional
chkrootkit_0.46a.orig.tar.gz
cf2db5facf635daca8ec95074d3b73fb 16156 misc optional chkrootkit_0.46a-1.diff.gz
e320dde000aaa8b5181981e67f8cb4b4 251344 misc optional
chkrootkit_0.46a-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFDhkJINFhjq9qkdRERAnzIAJ4jjAFY1FTYabRm7N7Y5eoEIs4bNwCggDW+
P2Sw47HdT192UGnErKAXOhY=
=VzBG
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
