From owner-freebsd-security@FreeBSD.ORG  Mon May  3 07:12:44 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 064D016A4CE
	for <freebsd-security@freebsd.org>;
	Mon,  3 May 2004 07:12:44 -0700 (PDT)
Received: from kraid.nerim.net (smtp-101-monday.nerim.net [62.4.16.101])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 71F5043D54
	for <freebsd-security@freebsd.org>;
	Mon,  3 May 2004 07:12:41 -0700 (PDT)	(envelope-from artur@pydo.org)
Received: from bastion.pydo.net (bastion.pydo.net [62.212.97.116])
	by kraid.nerim.net (Postfix) with ESMTP id 5711C41A66
	for <freebsd-security@freebsd.org>;
	Mon,  3 May 2004 16:12:39 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by bastion.pydo.net (Postfix) with ESMTP
	id B89864C259; Mon,  3 May 2004 15:55:38 +0200 (CEST)
Received: from bastion.pydo.net ([127.0.0.1])
 by localhost (fw.pydo.net [127.0.0.1]) (amavisd-new, port 10024) with LMTP
 id 73408-03-6; Mon,  3 May 2004 15:55:31 +0200 (CEST)
Received: from pydo.org (univers.ipv6.pydo.org
	[IPv6:2001:618:472:0:250:8dff:fea5:1452])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested)
	by bastion.pydo.net (Postfix) with ESMTP
	id 748B14C258; Mon,  3 May 2004 15:55:31 +0200 (CEST)
Message-ID: <40964F53.60408@pydo.org>
Date: Mon, 03 May 2004 15:55:31 +0200
From: Artur Pydo <artur@pydo.org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.6) Gecko/20040113
X-Accept-Language: fr-fr, fr, en-us, en
MIME-Version: 1.0
To: andy@lewman.com
References: <20040501125409.GA65876@phobos.osem.com>
In-Reply-To: <20040501125409.GA65876@phobos.osem.com>
X-Enigmail-Version: 0.83.1.0
X-Enigmail-Supports: pgp-inline, pgp-mime
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-new at pydo.net
cc: freebsd-security@freebsd.org
Subject: Re: chkrootkit and 4.10-prerelease issues?
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 03 May 2004 14:12:44 -0000

Hello,

andy@lewman.com wrote:

> Has anyone else seen chkrootkit (version 0.43) on 4.10-prerelease or
> later report chfn, chsh, and date as infected?

This is a reported bug of freebsd version detection in the shell script.
It should be corrected in the next release of chkrootkit.

-- 

Best regards,

Artur Pydo.