pkgsrc-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[pkgsrc/trunk]: pkgsrc/security/audit-packages Update audit-packages to versi...
details: https://anonhg.NetBSD.org/pkgsrc/rev/5aedde7d0e40
branches: trunk
changeset: 501296:5aedde7d0e40
user: agc <agc%pkgsrc.org@localhost>
date: Thu Oct 20 10:26:54 2005 +0000
description:
Update audit-packages to version 1.39
Give the audit-pacakges a "-d" option to download the vulnerabilities file
with downloaad-vulnerability-list before scanning the installed packages.
Update the documentation accordingly.
Get rid of some inconsistent style problems in the audit-packages script.
diffstat:
security/audit-packages/Makefile | 5 +-
security/audit-packages/files/audit-packages | 27 ++--
security/audit-packages/files/audit-packages.0 | 81 +++++++-------
security/audit-packages/files/audit-packages.8 | 9 +-
security/audit-packages/files/download-vulnerability-list | 3 +-
5 files changed, 69 insertions(+), 56 deletions(-)
diffs (259 lines):
diff -r da65e7318974 -r 5aedde7d0e40 security/audit-packages/Makefile
--- a/security/audit-packages/Makefile Thu Oct 20 10:06:46 2005 +0000
+++ b/security/audit-packages/Makefile Thu Oct 20 10:26:54 2005 +0000
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.59 2005/08/04 12:02:59 rillig Exp $
+# $NetBSD: Makefile,v 1.60 2005/10/20 10:26:54 agc Exp $
-DISTNAME= audit-packages-1.38
+DISTNAME= audit-packages-1.39
CATEGORIES= security pkgtools
MASTER_SITES= # empty
DISTFILES= # empty
@@ -30,6 +30,7 @@
-e 's|@FETCH_CMD_SHORT@|${FETCH_CMD:T}|g' \
-e 's|@PKGSRCDIR@|${PKGSRCDIR}|g' \
-e 's|@PKG_TOOLS_BIN@|${PKG_TOOLS_BIN}|g' \
+ -e 's|@PREFIX@|${PREFIX}|g' \
-e 's|@SH@|${SH}|g' \
-e 's|@DIGEST@|${DIGEST}|g' \
-e 's|@CHMOD@|${CHMOD}|g' \
diff -r da65e7318974 -r 5aedde7d0e40 security/audit-packages/files/audit-packages
--- a/security/audit-packages/files/audit-packages Thu Oct 20 10:06:46 2005 +0000
+++ b/security/audit-packages/files/audit-packages Thu Oct 20 10:26:54 2005 +0000
@@ -1,6 +1,6 @@
#! @SH@
#
-# $NetBSD: audit-packages,v 1.22 2005/08/04 12:02:59 rillig Exp $
+# $NetBSD: audit-packages,v 1.23 2005/10/20 10:26:54 agc Exp $
#
# Copyright (c) 2000-2003 Alistair Crooks. All rights reserved.
#
@@ -50,19 +50,28 @@
vuls="${PKGVULNDIR}/pkg-vulnerabilities"
+download=no
verbose=no
while [ $# -gt 0 ]; do
case "$1" in
+ -d) download=yes ;;
-v) verbose=yes ;;
esac
shift
done
+# try to download vulnerability list, as requested
+# the integrity of the list is checked below
+# so just issue a warning if there was a failure
+case "$download" in
+yes) @PREFIX@/sbin/download-vulnerability-list || \
+ echo "***WARNING***: download-vulnerability-list failure" 1>&2;;
+esac
+
errmsg=""
# check for missing vulnerabilities file
-if [ ! -f "$vuls" ]
-then
+if [ ! -f "$vuls" ]; then
errmsg="Missing vulnerabilities file $vuls"
errsolution="$ERR_DOWNLOAD"
fi
@@ -78,8 +87,7 @@
case "$errmsg" in
"") # check that pkg_info is new enough (supports ranges)
- if [ `@PKG_TOOLS_BIN@/pkg_info -V` -lt "$PKG_INSTALL_REQUIRED" ]
- then
+ if [ `@PKG_TOOLS_BIN@/pkg_info -V` -lt "$PKG_INSTALL_REQUIRED" ]; then
errmsg='Installed pkg_info is too old.'
errsolution="$ERR_PKGINSTALL"
fi
@@ -90,15 +98,12 @@
"") # check format version of vulnerabilities file
file_major=`@AWK@ '$1 == "#FORMAT" { split($2, a, "\\\\."); print a[1] }' "$vuls"`
file_minor=`@AWK@ '$1 == "#FORMAT" { split($2, a, "\\\\."); print a[2] }' "$vuls"`
- if [ "x$file_major" = "x" -o "x$file_minor" = "x" ]
- then
+ if [ "x$file_major" = "x" -o "x$file_minor" = "x" ]; then
errmsg="No file format version found in $vuls"
errsolution="$ERR_DOWNLOAD"
- elif [ "$file_major" -ne "$FORMAT_MAJOR" -o "$file_minor" -gt "$FORMAT_MINOR" ]
- then
+ elif [ "$file_major" -ne "$FORMAT_MAJOR" -o "$file_minor" -gt "$FORMAT_MINOR" ]; then
errmsg="Unsupported file format version $file_major.$file_minor in $vuls (supported version: $FORMAT_MAJOR.$FORMAT_MINOR)."
- if [ "$file_major" -le "$FORMAT_MAJOR" ]
- then
+ if [ "$file_major" -le "$FORMAT_MAJOR" ]; then
errsolution="$ERR_DOWNLOAD"
else
errsolution="$ERR_UPGRADE"
diff -r da65e7318974 -r 5aedde7d0e40 security/audit-packages/files/audit-packages.0
--- a/security/audit-packages/files/audit-packages.0 Thu Oct 20 10:06:46 2005 +0000
+++ b/security/audit-packages/files/audit-packages.0 Thu Oct 20 10:26:54 2005 +0000
@@ -1,11 +1,11 @@
AUDIT-PACKAGES(8) NetBSD System Manager's Manual AUDIT-PACKAGES(8)
NNAAMMEE
- aauuddiitt--ppaacckkaaggeess, ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt - show vulnerabilities in
+ aauuddiitt--ppaacckkaaggeess, ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt -- show vulnerabilities in
installed packages
SSYYNNOOPPSSIISS
- aauuddiitt--ppaacckkaaggeess [--vv]
+ aauuddiitt--ppaacckkaaggeess [--ddvv]
ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt
DDEESSCCRRIIPPTTIIOONN
@@ -14,7 +14,9 @@
dard output. This output contains the name and version of the package,
the type of vulnerability, and an URL for further information for each
vulnerable package. If the --vv option is specified, aauuddiitt--ppaacckkaaggeess will
- warn when the vulnerabilities file is more than a week old.
+ warn when the vulnerabilities file is more than a week old. The --dd
+ option will attempt to download this vulnerabilities file before scanning
+ the installed packages for vulnerabilities.
The ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt program downloads this file from
_f_t_p_:_/_/_f_t_p_._N_e_t_B_S_D_._o_r_g_/_p_u_b_/_N_e_t_B_S_D_/_p_a_c_k_a_g_e_s_/_d_i_s_t_f_i_l_e_s_/_p_k_g_-_v_u_l_n_e_r_a_b_i_l_i_t_i_e_s
@@ -25,40 +27,40 @@
Each line lists the package and vulnerable versions, the type of exploit,
and an Internet address for further information. The type of exploit can
be any text, although some common types of exploits listed are:
- oo cross-site-html
- oo cross-site-scripting
- oo denial-of-service
- oo file-permissions
- oo local-access
- oo local-code-execution
- oo local-file-read
- oo local-file-removal
- oo local-file-write
- oo local-root-file-view
- oo local-root-shell
- oo local-symlink-race
- oo local-user-file-view
- oo local-user-shell
- oo privacy-leak
- oo remote-code-execution
- oo remote-command-inject
- oo remote-file-creation
- oo remote-file-read
- oo remote-file-view
- oo remote-file-write
- oo remote-key-theft
- oo remote-root-access
- oo remote-root-shell
- oo remote-script-inject
- oo remote-server-admin
- oo remote-use-of-secret
- oo remote-user-access
- oo remote-user-file-view
- oo remote-user-shell
- oo unknown
- oo weak-authentication
- oo weak-encryption
- oo weak-ssl-authentication
+ ++oo cross-site-html
+ ++oo cross-site-scripting
+ ++oo denial-of-service
+ ++oo file-permissions
+ ++oo local-access
+ ++oo local-code-execution
+ ++oo local-file-read
+ ++oo local-file-removal
+ ++oo local-file-write
+ ++oo local-root-file-view
+ ++oo local-root-shell
+ ++oo local-symlink-race
+ ++oo local-user-file-view
+ ++oo local-user-shell
+ ++oo privacy-leak
+ ++oo remote-code-execution
+ ++oo remote-command-inject
+ ++oo remote-file-creation
+ ++oo remote-file-read
+ ++oo remote-file-view
+ ++oo remote-file-write
+ ++oo remote-key-theft
+ ++oo remote-root-access
+ ++oo remote-root-shell
+ ++oo remote-script-inject
+ ++oo remote-server-admin
+ ++oo remote-use-of-secret
+ ++oo remote-user-access
+ ++oo remote-user-file-view
+ ++oo remote-user-shell
+ ++oo unknown
+ ++oo weak-authentication
+ ++oo weak-encryption
+ ++oo weak-ssl-authentication
By default, the vulnerabilities file is stored in the @PKGVULNDIR@ direc-
tory. This can be changed by defining the environment variable
@@ -123,8 +125,7 @@
Update the _p_k_g_t_o_o_l_s_/_p_k_g___i_n_s_t_a_l_l package.
SSEEEE AALLSSOO
- pkg_info(1), mk.conf(5), packages(7), @PKGSRCDIR@/mk/defaults/mk.conf
- and
+ pkg_info(1), mk.conf(5), packages(7), @PKGSRCDIR@/mk/defaults/mk.conf and
_D_o_c_u_m_e_n_t_a_t_i_o_n _o_n _t_h_e _N_e_t_B_S_D _P_a_c_k_a_g_e _S_y_s_t_e_m. @PKGSRCDIR@/doc/pkgsrc.txt
@@ -134,4 +135,4 @@
September 19, 2000. The original idea came from Roland Dowdeswell and
Bill Sommerfeld.
-NetBSD 2.0.2 June 9, 2005 NetBSD 2.0.2
+NetBSD 3.0 June 9, 2005 NetBSD 3.0
diff -r da65e7318974 -r 5aedde7d0e40 security/audit-packages/files/audit-packages.8
--- a/security/audit-packages/files/audit-packages.8 Thu Oct 20 10:06:46 2005 +0000
+++ b/security/audit-packages/files/audit-packages.8 Thu Oct 20 10:26:54 2005 +0000
@@ -1,4 +1,4 @@
-.\" $NetBSD: audit-packages.8,v 1.14 2005/08/02 00:23:31 reed Exp $
+.\" $NetBSD: audit-packages.8,v 1.15 2005/10/20 10:26:54 agc Exp $
.\"
.\" Copyright (c) 2003 Jeremy C. Reed. All rights reserved.
.\"
@@ -39,7 +39,7 @@
.Nd show vulnerabilities in installed packages
.Sh SYNOPSIS
.Nm
-.Op Fl v
+.Op Fl dv
.Nm download-vulnerability-list
.Sh DESCRIPTION
The
@@ -55,6 +55,11 @@
option is specified,
.Nm
will warn when the vulnerabilities file is more than a week old.
+The
+.Fl d
+option will attempt to download this vulnerabilities
+file before scanning
+the installed packages for vulnerabilities.
.Pp
The
.Nm download-vulnerability-list
diff -r da65e7318974 -r 5aedde7d0e40 security/audit-packages/files/download-vulnerability-list
--- a/security/audit-packages/files/download-vulnerability-list Thu Oct 20 10:06:46 2005 +0000
+++ b/security/audit-packages/files/download-vulnerability-list Thu Oct 20 10:26:54 2005 +0000
@@ -1,6 +1,6 @@
#! @SH@
-# $NetBSD: download-vulnerability-list,v 1.26 2005/02/11 16:51:16 agc Exp $
+# $NetBSD: download-vulnerability-list,v 1.27 2005/10/20 10:26:54 agc Exp $
#
# Copyright (c) 2000-2003 Alistair Crooks. All rights reserved.
#
@@ -39,6 +39,7 @@
NEW_VUL_LIST=pkg-vulnerabilities.$$
EXIST_VUL_LIST=pkg-vulnerabilities
+# pick up any settings in audit-packages.conf
if [ -r @PKG_SYSCONFDIR@/audit-packages.conf ]; then
echo "Reading settings from @PKG_SYSCONFDIR@/audit-packages.conf"
. @PKG_SYSCONFDIR@/audit-packages.conf
Home |
Main Index |
Thread Index |
Old Index