bugTiger UNIX security tool - Bugs: bug #52087, deb_checkmd5sums is not checking...

 
 

bug #52087: deb_checkmd5sums is not checking MD5 checksums!

Submitter:  François Gouget <fgouget>
Submitted:  Fri 22 Sep 2017 09:02:07 AM UTC
   
 
Category:  Security check modules Severity:  5-Critical
Item Group:  Script error Status:  In Progress
Privacy:  Public Assigned to:  jfs
Open/Closed:  Open Operating System:  Debian GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 04 Feb 2018 01:18:35 PM UTC, comment #1: 

Thank you for spotting this bug when calling prelink. I have yet to investigate how does tiger work together with prelink (i.e. confirm that Debian bug #445531 is not relevant anymore).

In the meantime, I have modified the script so -c is not appended if prelink is called instead of MD5SUM.


Javier Fernandez-Sanguino Peña <jfs>
Group administrator
Fri 22 Sep 2017 09:02:07 AM UTC, original submission:  

The issue is that deb_checkmd5sums tries to use prelink to compute the checksums if present:

    MD5SUM="$PRELINK -y --md5"

However the script then adds the -c option for its main loop:

$MD5SUM -c 2>&1 | $SED -e "s/^.*md5sum: MD5 check failed for '\(.*\)'/DIFF \1/; s/^.*md5sum: can't open \(.*\)/ERR \1/" | {
while read file err

The problem is prelink does not have a '-c' option, causing it to only report an error:

$ echo 1234 /usr/sbin/prelink | prelink -y --md5 -c
/usr/sbin/prelink.bin: option requires an argument -- 'c'
Try `prelink.bin --help' or `prelink.bin --usage' for more information.

As a result the main loop does not check the MD5 checksums at all. Instead it runs twice, first with file="/usr/sbin/prelink.bin:" and then with file="Try".

As far as I can tell, the issue that triggered the use of prelink (Debian bug #445531) no longer exists so that computing the MD5 checksums the normal way works just fine.

So I propose the attached patch.

François Gouget <fgouget>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #41869:  checkmd5.diff added by fgouget (1KiB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jfs (Posted a comment)
  • -email is unavailable- added by fgouget (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-02-04 jfs StatusNone In Progress
        Assigned toNone jfs
    2017-09-22 fgouget Attached File- Added checkmd5.diff, #41869

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code