1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
AUDIT-PACKAGES(8) NetBSD System Manager's Manual AUDIT-PACKAGES(8)
NNAAMMEE
aauuddiitt--ppaacckkaaggeess, ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt - show vulnerabilities in
installed packages
SSYYNNOOPPSSIISS
aauuddiitt--ppaacckkaaggeess [--vv]
ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt
DDEESSCCRRIIPPTTIIOONN
The aauuddiitt--ppaacckkaaggeess program compares the installed packages with the
_p_k_g_-_v_u_l_n_e_r_a_b_i_l_i_t_i_e_s file and reports any known security issues to stan-
dard output. This output contains the name and version of the package,
the type of vulnerability, and an URL for further information for each
vulnerable package.
The ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt program downloads this file from
_f_t_p_:_/_/_f_t_p_._N_e_t_B_S_D_._o_r_g_/_p_u_b_/_N_e_t_B_S_D_/_p_a_c_k_a_g_e_s_/_d_i_s_t_f_i_l_e_s_/_p_k_g_-_v_u_l_n_e_r_a_b_i_l_i_t_i_e_s
using ftp(1). This vulnerabilities file documents all known security
issues in pkgsrc packages and is kept up-to-date by the NetBSD packages
team.
Each line lists the package and vulnerable versions, the type of exploit,
and an Internet address for further information. The type of exploit can
be any text, although some common types of exploits listed are:
++oo cross-site-html
++oo cross-site-scripting
++oo denial-of-service
++oo file-permissions
++oo local-access
++oo local-code-execution
++oo local-file-read
++oo local-file-removal
++oo local-file-write
++oo local-root-file-view
++oo local-root-shell
++oo local-symlink-race
++oo local-user-file-view
++oo local-user-shell
++oo privacy-leak
++oo remote-code-execution
++oo remote-command-inject
++oo remote-file-creation
++oo remote-file-read
++oo remote-file-view
++oo remote-file-write
++oo remote-key-theft
++oo remote-root-access
++oo remote-root-shell
++oo remote-script-inject
++oo remote-server-admin
++oo remote-use-of-secret
++oo remote-user-access
++oo remote-user-file-view
++oo remote-user-shell
++oo unknown
++oo weak-authentication
++oo weak-encryption
++oo weak-ssl-authentication
By default, the vulnerabilities file is stored in the
_/_u_s_r_/_p_k_g_s_r_c_/_d_i_s_t_f_i_l_e_s directory. This can be changed by defining the
environment variable PKGVULNDIR to the directory containing the vulnera-
bilities file.
EENNVVIIRROONNMMEENNTT
These variables can also be defined in the
_/_u_s_r_/_p_k_g_/_e_t_c_/_a_u_d_i_t_-_p_a_c_k_a_g_e_s_._c_o_n_f file.
PKGVULNDIR Specifies the directory containing the _p_k_g_-_v_u_l_n_e_r_a_b_i_l_i_t_i_e_s
file.
FETCH_ARGS Specifies optional arguments for the ftp client.
FFIILLEESS
_/_u_s_r_/_p_k_g_s_r_c_/_d_i_s_t_f_i_l_e_s_/_p_k_g_-_v_u_l_n_e_r_a_b_i_l_i_t_i_e_s
_/_u_s_r_/_p_k_g_/_e_t_c_/_a_u_d_i_t_-_p_a_c_k_a_g_e_s_._c_o_n_f
EEXXAAMMPPLLEESS
The ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt command can be run via cron(8) to update
the _p_k_g_-_v_u_l_n_e_r_a_b_i_l_i_t_i_e_s file daily. And aauuddiitt--ppaacckkaaggeess can be run via
cron(8) (or with NetBSD's _/_e_t_c_/_s_e_c_u_r_i_t_y_._l_o_c_a_l daily security script).
The ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt command can be forced to use IPv4 with
the following setting in _/_u_s_r_/_p_k_g_/_e_t_c_/_a_u_d_i_t_-_p_a_c_k_a_g_e_s_._c_o_n_f:
export FETCH_ARGS="-4"
SSEEEE AALLSSOO
pkg_info(1), mk.conf(5), packages(7), _/_u_s_r_/_p_k_g_s_r_c_/_m_k_/_b_s_d_._p_k_g_._d_e_f_a_u_l_t_s_._m_k
and
_D_o_c_u_m_e_n_t_a_t_i_o_n _o_n _t_h_e _N_e_t_B_S_D _P_a_c_k_a_g_e _S_y_s_t_e_m. _/_u_s_r_/_p_k_g_s_r_c_/_P_a_c_k_a_g_e_s_._t_x_t
HHIISSTTOORRYY
The aauuddiitt--ppaacckkaaggeess and ddoowwnnllooaadd--vvuullnneerraabbiilliittyy--lliisstt commands were origi-
nally implemented and added to NetBSD's pkgsrc by Alistair Crooks on
September 19, 2000. The original idea came from Roland Dowdeswell and
Bill Sommerfeld.
NetBSD 1.6 January 1, 2004 NetBSD 1.6
|
