tags 351861 + upstream
thanks for the report.
Elliott Mitchell <[EMAIL PROTECTED]> writes:
> First, the RUNNING=... will only give a string if the program is running
> at the time.
this portion of the bug report has already been fixed as of 0.45-1.
> Second, the RUNNING=`...| ${egrep} -v chkrootkit |..." test is incorrect.
> Though unusual, one can make a symbolic link to chkrootkit and execute
> the link. A more likely case is to copy the script to another file for
> debuging. The script should save $0 for use in this test. Additionally
> naming a rootkit "sshd.chkrootkit" could be used to cloak from this test.
i'll forward this bit upstream.
-l
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
