bugTiger UNIX security tool - Bugs: bug #52087, deb_checkmd5sums is not checking...

 
 

bug #52087: deb_checkmd5sums is not checking MD5 checksums!

Submitted by:  Fran├žois Gouget <fgouget>
Submitted on:  Fri 22 Sep 2017 09:02:07 AM UTC  
 
Category: Security check modulesSeverity: 5-Critical
Item Group: Script errorStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenOperating System: Debian GNU/Linux

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 22 Sep 2017 09:02:07 AM UTC, original submission:

The issue is that deb_checkmd5sums tries to use prelink to compute the checksums if present:

MD5SUM="$PRELINK -y --md5"

However the script then adds the -c option for its main loop:

$MD5SUM -c 2>&1 | $SED -e "s/^.md5sum: MD5 check failed for '\(.\)'/DIFF \1/; s/^.md5sum: can't open \(.\)/ERR \1/" | {
while read file err

The problem is prelink does not have a '-c' option, causing it to only report an error:

$ echo 1234 /usr/sbin/prelink | prelink -y --md5 -c
/usr/sbin/prelink.bin: option requires an argument -- 'c'
Try `prelink.bin --help' or `prelink.bin --usage' for more information.

As a result the main loop does not check the MD5 checksums at all. Instead it runs twice, first with file="/usr/sbin/prelink.bin:" and then with file="Try".

As far as I can tell, the issue that triggered the use of prelink (Debian bug #445531) no longer exists so that computing the MD5 checksums the normal way works just fine.

So I propose the attached patch.

Fran├žois Gouget <fgouget>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41869:  checkmd5.diff added by fgouget (1KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by fgouget (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 22 Sep 2017 09:02:07 AM UTCfgougetAttached File-=>Added checkmd5.diff, #41869

    Back to the top


    Powered by Savane 3.1-cleanup1