freebsd security - May 2004 - chkrootkit and 4.10-prerelease issues?

Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or
later report chfn, chsh, and date as infected?

I built world yesterday, and my nightly chkrootkit reports this on run.
I've replaced the binaries with their 4.9 equivalents, and things don't
report as infected.  I upgrade the 4.9 machine to 4.10, and chkrootkit
reports them as infected again.  

Is this similar to the 5.x issues with chkrootkit?

-- 
Andrew

Probably because chrootkit doesn't know u builtworld and is still checking
whether chfn & chsh are infected against 4.9 MD5 Sums, I would suggest
reading the manual and seeing how to fix this or just reinstall it.

- Mark

-----Original Message-----
From: owner-freebsd-security@freebsd.org
[mailto:owner-freebsd-security@freebsd.org] On Behalf Of andy@lewman.com
Sent: Saturday, 1 May 2004 10:54 pm
To: freebsd-security@freebsd.org
Subject: chkrootkit and 4.10-prerelease issues?

Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or later
report chfn, chsh, and date as infected?

I built world yesterday, and my nightly chkrootkit reports this on run.
I've replaced the binaries with their 4.9 equivalents, and things don't
report as infected.  I upgrade the 4.9 machine to 4.10, and chkrootkit
reports them as infected again.  

Is this similar to the 5.x issues with chkrootkit?

--
Andrew
_______________________________________________
freebsd-security@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to
"freebsd-security-unsubscribe@freebsd.org"

> Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or
> later report chfn, chsh, and date as infected?
> Is this similar to the 5.x issues with chkrootkit?
Almost always. Mostly "date",
but sometimes "ps", "ls"...
First time I was scared to
death.
Nice little app with own
secret life.

                    ZK

Hello,

andy@lewman.com wrote:
> Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or
> later report chfn, chsh, and date as infected?
This is a reported bug of freebsd version detection in the shell script.
It should be corrected in the next release of chkrootkit.

-- 

Best regards,

Artur Pydo.