bugtraq - AIDE problem handling symlinks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 27 Nov 2006 15:42:53 +0000 (GMT)
From: fryxar fryxar <fryxar@...oo.com.ar>
To: bugtraq@...urityfocus.com
Subject: AIDE problem handling symlinks

AIDE (Advanced Intrusion Detection Environment) is a
tool that creates a Database that can be used to
verify the integrity of files.

As modern filesystems (ext2, ufs, etc) implement fast
symlinks to store target's pathname, if only checksums
options (sha1, md5, tiger, etc) are used to check the
integrity of a soft link file, AIDE will not be able
to detect changes made on it.

If you use a mtime/ctime option, and somebody change a
target's pathname, AIDE will show it, but these
options are easy trickly with a standard Unix "touch"
command (and root privilege, of course).

So, I added the new option "l" to AIDE, to implement a
target's pathname comparison for symbolic links
against the database.  If a target's pathname is
changed on a symlink file, the difference will be
showed.

Please upgrade your AIDE tool to the last version
available (>= 0.13-r1)

__________________________________________________
Correo Yahoo!
Espacio para todos tus mensajes, antivirus y antispam ¡gratis! 
¡Abrí tu cuenta ya! - http://correo.yahoo.com.ar