[Bug 695317] New: rkhunter cron script contains unquoted variable

newer
[Bug 680229] New: Yast media check...

bugzilla_noreply＠novell.com

22 May 2011 22 May '11

05:50

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c0 Summary: rkhunter cron script contains unquoted variable Classification: openSUSE Product: openSUSE 11.4 Version: Factory Platform: Other OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: volker3204@paradise.net.nz QAContact: qa@suse.de Found By: --- Blocker: --- Created an attachment (id=430753) --> (http://bugzilla.novell.com/attachment.cgi?id=430753) Patch with fix User-Agent: Mozilla/5.0 (compatible; Konqueror/4.6; Linux) KHTML/4.6.0 (like Gecko) SUSE The mails sent by the rkhunter check script have a subject with random strings because the corresponding variable in /etc/cron.daily/suse.de-rkhunter is missing proper quotes. Not many variables in that script are quoted safely - not good IMHO for root scripts. Reproducible: Always Steps to Reproduce: 1. Run /etc/cron.daily/suse.de-rkhunter 2. Look at resulting email Actual Results: Part of subject contains random string or is empty. Expected Results: The string intended to be there. Fix in attached patch. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

bugzilla_noreply＠novell.com

23 May 23 May

08:31

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c1 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |NEEDINFO CC| |meissner@novell.com InfoProvider| |volker3204@paradise.net.nz --- Comment #1 from Marcus Meissner 2011-05-23 08:31:49 UTC --- which OBS project did you get it from? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:00

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c2 Volker Kuhlmann changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW CC| |volker3204@paradise.net.nz InfoProvider|volker3204@paradise.net.nz | --- Comment #2 from Volker Kuhlmann 2011-05-23 11:00:18 UTC --- Sorry I didn't notice it was from contrib, I find the current BS structure a bit confusing. It's rkhunter-1.3.8-4.2.x86_64 Vendor: obs://build.opensuse.org/openSUSE:11.4:Contrib and searching OBS there is only that one in openSUSE:11.4:Contrib/standard and another in security/openSUSE_11.4, which however has exactly the same bad script. That sort of programming shouldn't be shipped with security software :-( -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:48

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c3 Marcus Meissner changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.pr |Sascha.Manns@open-slx.de |ovo.novell.com | --- Comment #3 from Marcus Meissner 2011-05-23 11:48:06 UTC --- $ osc ls -u openSUSE:11.4:Contrib rkhunter |less _link $ osc cat -u openSUSE:11.4:Contrib rkhunter _link|less <link project="home:saigkill" package="rkhunter"/> $ osc ls home:saigkill .. no rkhunter ... I really wonder why there was a copy of a link in contrib 11.4. anyway, for you Sascha. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:07

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c4 --- Comment #4 from Volker Kuhlmann 2011-05-23 13:07:37 UTC --- Hm, I'm not making this up. My policy is to set keeppackages for all repos.

...

rpm -q rkhunter rkhunter-1.3.8-4.2.x86_64

...

rpm -qi rkhunter Name : rkhunter Relocations: (not relocatable) Version : 1.3.8 Vendor: obs://build.opensuse.org/openSUSE:11.4:Contrib Release : 4.2 Build Date: Wed 09 Mar 2011 10:21:35 NZDT Install Date: Mon 25 Apr 2011 11:34:23 NZST Build Host: build17 Group : System/Monitoring Source RPM: rkhunter-1.3.8-4.2.src.rpm Size : 879314 License: GPL v3 Signature : DSA/SHA1, Wed 09 Mar 2011 10:22:49 NZDT, Key ID 4c236e3c62b21ea4

...

dl -d /var/cache/zypp/packages/ | grep rkhunt 190418 2011-04-25 11:34:19 download.opensuse.org-standard/x86_64/rkhunter-1.3.8-4.2.x86_64.rpm

...

grep -l download.opensuse.org-standard /etc/zypp/repos.d/* /etc/zypp/repos.d/download.opensuse.org-standard.repo

...

cat /etc/zypp/repos.d/download.opensuse.org-standard.repo [download.opensuse.org-standard] name=Main Repository (Contrib) .. baseurl=http://download.opensuse.org/repositories/openSUSE:/11.4:/Contrib/standard/

This is where is most surely came from. It is 1 of 2 packages found here (first one): http://software.opensuse.org/search?baseproject=openSUSE%3A11.4&p=1&q=rkhunter I checked, and the second package has exactly the same broken script: http://software.opensuse.org/search/download?base=openSUSE%3A11.4&file=security%2FopenSUSE_11.4%2Fx86_64%2Frkhunter-1.3.8-1.1.x86_64.rpm HTH -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:35

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c5 --- Comment #5 from Marcus Meissner 2011-05-23 13:35:21 UTC --- i didnt say you are making this up ;) Without looking, there probably is a bug, I just needed to find the maintainer to assign it too. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

24 May 24 May

06:33

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c Sascha Manns changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

06:33

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c6 --- Comment #6 from Sascha Manns 2011-05-24 06:33:21 UTC --- Hello Mates. The rkhunter Package who was published in the Contrib Repository now is moved to security. After all is fine rkhunter will submitted to Factory. The Contrib Repository itself will be closed soon. What exactly shoud changed in rkhunter? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:50

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c7 --- Comment #7 from Volker Kuhlmann 2011-05-24 09:50:55 UTC --- @Marcus: ;-) Just giving more info; as it turns out, both packages are broken. @Sascha: Sorry I don't mean to be rude, but are you serious? Have you read the bug's "$SUBJECT"? /etc/cron.daily/suse.de-rkhunter was written by someone who needs a lesson in safe shell script programming. I had already attached a fix for the most obvious error (which is a manifestation of unsafe shell script programming). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:34

New subject: [Bug 695317] rkhunter cron script contains unquoted variable

https://bugzilla.novell.com/show_bug.cgi?id=695317 https://bugzilla.novell.com/show_bug.cgi?id=695317#c8 Sascha Manns changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution| |FIXED --- Comment #8 from Sascha Manns 2011-05-24 11:34:31 UTC --- Aha, i haven't seen the patch. Now its included into the Main Package in security. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

4727

Age (days ago)

4729

Last active (days ago)

List overview

Download

9 comments

1 participants

participants (1)

bugzilla_noreply＠novell.com

[Bug 695317] New: rkhunter cron script contains unquoted variable

tags

participants (1)