.\" $NetBSD: audit-packages.8,v 1.17 2005/11/16 22:54:58 wiz Exp $
.\"
.\" Copyright (c) 2003 Jeremy C. Reed.  All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\"    must display the following acknowledgement:
.\"      This product includes software developed by Jeremy C. Reed
.\"      for the NetBSD project.
.\" 4. The name of the author may not be used to endorse or promote
.\"    products derived from this software without specific prior written
.\"    permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
.\" OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
.\" WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
.\" DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
.\" GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
.\" WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
.\" NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
.\" SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd November 16, 2005
.Os
.Dt AUDIT-PACKAGES 8
.Sh NAME
.Nm audit-packages ,
.Nm download-vulnerability-list
.Nd show vulnerabilities in installed packages
.Sh SYNOPSIS
.Nm
.Op Fl dv
.Op Fl i Ar ignore-list
.Op Fl K Ar pkg_dbdir
.Op Fl p Ar package
.Nm download-vulnerability-list
.Sh DESCRIPTION
The
.Nm
program compares the installed packages with the
.Pa pkg-vulnerabilities
file and reports any known security issues to standard output.
This output contains the name and version of the package, the
type of vulnerability, and an URL for further information for each
vulnerable package.
.Pp
The following flags are supported:
.Bl -tag -width Ar
.It Fl d
.Nm
will attempt to download the vulnerabilities
file before scanning
the installed packages for vulnerabilities.
.It Fl i Oo Cm vulnid: Ns Ar vulnid Ns | Ns Cm pkgpat: Ns Ar pattern Oc
Specify a list of vulnerabilities or packages to ignore.
Packages can be specified using package wildcards (see
.Xr pkg_info 1 ) .
Vulnerabilities can be specified with the form
.Cm vulnid: Ns Ar vulnid .
Vulnerability ids are only present in file format 1.0.1 or higher.
.It Fl K Ar pkg_dbdir
Use package database directory
.Ar pkg_dbdir .
.It Fl p Ar package
Check only the package
.Ar package
for vulnerabilities.
.It Fl v
Set verbose mode.
.Nm
will warn when the vulnerabilities file is more than a week old.
.El
.Pp
The
.Nm download-vulnerability-list
program downloads this file from
.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/distfiles/pkg-vulnerabilities
using
.Xr @FETCH_CMD_SHORT@ 1 .
This vulnerabilities file documents all known security issues in
pkgsrc packages and is kept up-to-date by the
.Nx
pkgsrc-security team.
.Pp
Each line lists the package and vulnerable versions, the type of exploit,
and an Internet address for further information:
.Bl -item
.It
.Aq package pattern
.Ao vulnid Ac Ns , Ns Aq type
.Aq url
.El
.Pp
The type of exploit can be any text, although
some common types of exploits listed are:
.Bl -bullet -compact -offset indent
.It
cross-site-html
.It
cross-site-scripting
.It
denial-of-service
.It
file-permissions
.It
local-access
.It
local-code-execution
.It
local-file-read
.It
local-file-removal
.It
local-file-write
.It
local-root-file-view
.It
local-root-shell
.It
local-symlink-race
.It
local-user-file-view
.It
local-user-shell
.It
privacy-leak
.It
remote-code-execution
.It
remote-command-inject
.It
remote-file-creation
.It
remote-file-read
.It
remote-file-view
.It
remote-file-write
.It
remote-key-theft
.It
remote-root-access
.It
remote-root-shell
.It
remote-script-inject
.It
remote-server-admin
.It
remote-use-of-secret
.It
remote-user-access
.It
remote-user-file-view
.It
remote-user-shell
.It
unknown
.It
weak-authentication
.It
weak-encryption
.It
weak-ssl-authentication
.El
.Pp
By default, the vulnerabilities file is stored in the
@PKGVULNDIR@
directory.
This can be changed by defining the environment variable
.Ev PKGVULNDIR
to the directory containing the vulnerabilities file.
.Sh EXIT STATUS
.Ex -std audit-packages
.Sh ENVIRONMENT
These variables can also be defined in the
@PKG_SYSCONFDIR@/audit-packages.conf
file.
.Pp
.Bl -tag -width PKGVULNDIR
.It Ev PKGVULNDIR
Specifies the directory containing the
.Pa pkg-vulnerabilities
file.
.It Ev FETCH_ARGS
Specifies optional arguments for the ftp client.
.El
.Sh FILES
@PKGVULNDIR@/pkg-vulnerabilities
.Pp
@PKG_SYSCONFDIR@/audit-packages.conf
.Sh EXAMPLES
The
.Nm download-vulnerability-list
command can be run via
.Xr cron 8
to update the
.Pa pkg-vulnerabilities
file daily.
And
.Nm
can be run via
.Xr cron 8
(or with
.Nx Ap s
.Pa /etc/security.local
daily security script).
.Pp
The
.Nm download-vulnerability-list
command can be forced to use IPv4 with the following setting in
@PKG_SYSCONFDIR@/audit-packages.conf :
.Pp
export FETCH_ARGS="-4"
.Sh DIAGNOSTICS
The following errors can occur:
.Bl -tag -width 10n
.It Checksum mismatch
The vulnerabilities file is corrupted.
Run
.Nm download-vulnerability-list .
.It Missing vulnerabilities file
The vulnerabilities file could not be found.
Run
.Nm download-vulnerability-list .
.It \&No checksum algorithm found
The vulnerabilities file is too old or incomplete.
Run
.Nm download-vulnerability-list .
.It \&No checksum found
The vulnerabilities file is too old or incomplete.
Run
.Nm download-vulnerability-list .
.It \&No file format version found
The vulnerabilities file is too old or incomplete.
Run
.Nm download-vulnerability-list .
.It Unsupported file format version
The vulnerabilities file is too old or too new.
If it's too old, run
.Nm download-vulnerability-list .
If it's too new, update the
.Pa security/audit-packages
package.
.It Installed pkg_info too old
.Nm
requires a newer version of
.Xr pkg_info 1 .
Update the
.Pa pkgtools/pkg_install
package.
.El
.Sh SEE ALSO
.Xr pkg_info 1 ,
.Xr mk.conf 5 ,
.Xr packages 7 ,
@PKGSRCDIR@/mk/defaults/mk.conf
and
.Rs
.%T "Documentation on the NetBSD Package System"
.Re
@PKGSRCDIR@/doc/pkgsrc.txt
.Sh HISTORY
The
.Nm
and
.Nm download-vulnerability-list
commands were originally implemented and added to
.Nx Ap s
pkgsrc by
.An Alistair Crooks
on September 19, 2000.
The original idea came from Roland Dowdeswell and Bill Sommerfeld.