advisories/9313.adv

type: bugfix
subject: Updated rkhunter package eliminates false positive on gaskit rootkit
src:
  2:
   core:
    - rkhunter-1.3.8-3.1.mga2
  3:
   core:
    - rkhunter-1.4.0-3.1.mga3
description: |
  Using rkhunter on a Mageia 2 or 3 system, the gaskit rootkit was erroneously
  detected as it triggered on the presence of the directory /dev/dev which is
  commonly available on Mageia systems.

  Furthermore, the whitelisting of a file which no longer is present on
  Mageia 3 systems would prevent rkhunter from starting properly. Other files
  which should have been whitelisted were missing, resulting in warnings
  appearing.

  This update addresses these issues. rkhunter users are advised to install
  the updated package.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=9313
 - https://bugs.mageia.org/show_bug.cgi?id=9398
 - https://bugs.mageia.org/show_bug.cgi?id=8172
ID: MGAA-2013-0036
1	type: bugfix
2	subject: Updated rkhunter package eliminates false positive on gaskit rootkit
3	src:
4	2:
5	core:
6	- rkhunter-1.3.8-3.1.mga2
7	3:
8	core:
9	- rkhunter-1.4.0-3.1.mga3
10	description: \|
11	Using rkhunter on a Mageia 2 or 3 system, the gaskit rootkit was erroneously
12	detected as it triggered on the presence of the directory /dev/dev which is
13	commonly available on Mageia systems.
14
15	Furthermore, the whitelisting of a file which no longer is present on
16	Mageia 3 systems would prevent rkhunter from starting properly. Other files
17	which should have been whitelisted were missing, resulting in warnings
18	appearing.
19
20	This update addresses these issues. rkhunter users are advised to install
21	the updated package.
22	references:
23	- https://bugs.mageia.org/show_bug.cgi?id=9313
24	- https://bugs.mageia.org/show_bug.cgi?id=9398
25	- https://bugs.mageia.org/show_bug.cgi?id=8172
26	ID: MGAA-2013-0036