From owner-freebsd-security@FreeBSD.ORG  Wed Sep  7 11:56:39 2005
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
X-Original-To: freebsd-security@freebsd.org
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id EE63216A41F;
	Wed,  7 Sep 2005 11:56:39 +0000 (GMT)
	(envelope-from scheidell@secnap.net)
Received: from 0.mail.spammertrap.net (0.mail.spammertrap.net [204.89.241.173])
	by mx1.FreeBSD.org (Postfix) with ESMTP id A455E43D55;
	Wed,  7 Sep 2005 11:56:38 +0000 (GMT)
	(envelope-from scheidell@secnap.net)
Received: from localhost (localhost [127.0.0.1])
	by 0.mail.spammertrap.net (Postfix) with ESMTP id 830F818F3E4;
	Wed,  7 Sep 2005 07:56:37 -0400 (EDT)
Received: from secnap2.secnap.com (secnap2.secnap.com [204.89.241.128])
	by 0.mail.spammertrap.net (Postfix) with ESMTP id 5C7E618F3DF;
	Wed,  7 Sep 2005 07:56:36 -0400 (EDT)
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0
Date: Wed, 7 Sep 2005 07:56:49 -0400
Message-ID: <B3BCAF4246A8A84983A80DAB50FE72424C5F1F@secnap2.secnap.com>
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: Problem with portaudit's database
Thread-Index: AcWzoDqXHbc2bfdNQnGnGmdJh79rcQAAt5AQ
From: "Michael Scheidell" <scheidell@secnap.net>
To: "Simon L. Nielsen" <simon@FreeBSD.org>,
	"Dmitry Pryanishnikov" <dmitry@atlantis.dp.ua>
X-Virus-Scanned: SpammerTrap(tm) SME-250 1.45 at spammertrap.net
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=6.9
	tests=[AWL=-0.106, BAYES_00=-2.599, J_CHICKENPOX_93=0.6, LOCAL_RCVD=-5, 
	SPF_HELO_PASS=-0.001, SPF_PASS=-0.001]
X-Spam-Score: -7.107
X-Spam-Level: 
Cc: freebsd-security@freebsd.org
Subject: RE: Problem with portaudit's database
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Sep 2005 11:56:40 -0000


> -----Original Message-----
> From: owner-freebsd-security@freebsd.org=20
> [mailto:owner-freebsd-security@freebsd.org] On Behalf Of=20
> Simon L. Nielsen
> Sent: Wednesday, September 07, 2005 7:35 AM
> To: Dmitry Pryanishnikov
> Cc: freebsd-security@freebsd.org
> Subject: Re: Problem with portaudit's database
> On 2005.09.07 10:35:21 +0300, Dmitry Pryanishnikov wrote:
>=20
> >  Yesterday portaudit notified me about squid's vulnerability, but=20
> > today it didn't (despite I haven't upgraded squid). This=20
> has attracted=20
> > my attention, so I've compared yesterday's and today's=20
> auditfile.tbz:
> >=20
> > -r--r--r--  1 root  wheel   29875 Sep  6 15:40 auditfile.tbz
> >=20
> > vs.
> >=20
> > -r--r--r--  1 root  wheel    5685 Sep  7 10:11 auditfile.tbz

I had a similar problem (which was fixed with portaudit -F) so, I assume
that for a short time, the audit db was corrupted.