1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
.\" $NetBSD: audit-packages.8,v 1.7 2004/05/17 19:28:19 reed Exp $
.Dd May 12, 2004
.Os
.Dt AUDIT-PACKAGES 8
.Sh NAME
.Nm audit-packages ,
.Nm download-vulnerability-list
.Nd show vulnerabilities in installed packages
.Sh SYNOPSIS
.Nm
.Op Fl v
.Nm download-vulnerability-list
.Sh DESCRIPTION
The
.Nm
program compares the installed packages with the
.Pa pkg-vulnerabilities
file and reports any known security issues to standard output.
This output contains the name and version of the package, the
type of vulnerability, and an URL for further information for each
vulnerable package.
If the
.Fl v
option is specified,
.Nm
will warn when the vulnerabilities file is more than a week old.
.Pp
The
.Nm download-vulnerability-list
program downloads this file from
.Pa ftp://ftp.NetBSD.org/pub/NetBSD/packages/distfiles/pkg-vulnerabilities
using
.Xr @FETCH_CMD_SHORT@ 1 .
This vulnerabilities file documents all known security issues in
pkgsrc packages and is kept up-to-date by the
.Nx
packages team.
.Pp
Each line lists the package and vulnerable versions, the type of exploit,
and an Internet address for further information.
The type of exploit can be any text, although
some common types of exploits listed are:
.Bl -bullet -compact -offset indent
.It
cross-site-html
.It
cross-site-scripting
.It
denial-of-service
.It
file-permissions
.It
local-access
.It
local-code-execution
.It
local-file-read
.It
local-file-removal
.It
local-file-write
.It
local-root-file-view
.It
local-root-shell
.It
local-symlink-race
.It
local-user-file-view
.It
local-user-shell
.It
privacy-leak
.It
remote-code-execution
.It
remote-command-inject
.It
remote-file-creation
.It
remote-file-read
.It
remote-file-view
.It
remote-file-write
.It
remote-key-theft
.It
remote-root-access
.It
remote-root-shell
.It
remote-script-inject
.It
remote-server-admin
.It
remote-use-of-secret
.It
remote-user-access
.It
remote-user-file-view
.It
remote-user-shell
.It
unknown
.It
weak-authentication
.It
weak-encryption
.It
weak-ssl-authentication
.El
.Pp
By default, the vulnerabilities file is stored in the
.Pa @PKGVULNDIR@
directory.
This can be changed by defining the environment variable
.Ev PKGVULNDIR
to the directory containing the vulnerabilities file.
.Sh ENVIRONMENT
These variables can also be defined in the
.Pa @PKG_SYSCONFDIR@/audit-packages.conf
file.
.Pp
.Bl -tag -width PKGVULNDIR
.It Ev PKGVULNDIR
Specifies the directory containing the
.Pa pkg-vulnerabilities
file.
.It Ev FETCH_ARGS
Specifies optional arguments for the ftp client.
.El
.Sh FILES
.Pa @PKGVULNDIR@/pkg-vulnerabilities
.Pp
.Pa @PKG_SYSCONFDIR@/audit-packages.conf
.\" .Sh EXAMPLES
.Sh EXAMPLES
The
.Nm download-vulnerability-list
command can be run via
.Xr cron 8
to update the
.Pa pkg-vulnerabilities
file daily.
And
.Nm
can be run via
.Xr cron 8
(or with
.Nx Ns 's
.Pa /etc/security.local
daily security script).
.Pp
The
.Nm download-vulnerability-list
command can be forced to use IPv4 with the following setting in
.Pa @PKG_SYSCONFDIR@/audit-packages.conf :
.Pp
export FETCH_ARGS="-4"
.Sh SEE ALSO
.Xr pkg_info 1 ,
.Xr mk.conf 5 ,
.Xr packages 7 ,
.Pa @PKGSRCDIR@/mk/bsd.pkg.defaults.mk
and
.Rs
.%T "Documentation on the NetBSD Package System"
.Re
.Pa @PKGSRCDIR@/Packages.txt
.Sh HISTORY
The
.Nm
and
.Nm download-vulnerability-list
commands were originally implemented and added to
.Nx Ns 's
pkgsrc by
.An Alistair Crooks
on September 19, 2000.
The original idea came from Roland Dowdeswell and Bill Sommerfeld.
.\" .Sh AUTHORS
.\" .Sh SECURITY CONSIDERATIONS
|
