advisories/9313.adv

type: bugfix
subject: Updated rkhunter package eliminates false positive on gaskit rootkit
src:
  2:
   core:
    - rkhunter-1.3.8-3.1.mga2
  3:
   core:
    - rkhunter-1.4.0-3.1.mga3
description: |
  Using rkhunter on a Mageia 2 or 3 system, the gaskit rootkit was erroneously
  detected as it triggered on the presence of the directory /dev/dev which is
  commonly available on Mageia systems.

  Furthermore, the whitelisting of a file which no longer is present on
  Mageia 3 systems would prevent rkhunter from starting properly. Other files
  which should have been whitelisted were missing, resulting in warnings
  appearing.

  This update addresses these issues. rkhunter users are advised to install
  the updated package.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=9313
 - https://bugs.mageia.org/show_bug.cgi?id=9398
 - https://bugs.mageia.org/show_bug.cgi?id=8172
ID: MGAA-2013-0036
1	claire	70	type: bugfix
2			subject: Updated rkhunter package eliminates false positive on gaskit rootkit
3			src:
4			2:
5			core:
6			- rkhunter-1.3.8-3.1.mga2
7			3:
8			core:
9			- rkhunter-1.4.0-3.1.mga3
10			description: \|
11			Using rkhunter on a Mageia 2 or 3 system, the gaskit rootkit was erroneously
12			detected as it triggered on the presence of the directory /dev/dev which is
13			commonly available on Mageia systems.
14
15			Furthermore, the whitelisting of a file which no longer is present on
16			Mageia 3 systems would prevent rkhunter from starting properly. Other files
17			which should have been whitelisted were missing, resulting in warnings
18			appearing.
19
20			This update addresses these issues. rkhunter users are advised to install
21			the updated package.
22			references:
23			- https://bugs.mageia.org/show_bug.cgi?id=9313
24			- https://bugs.mageia.org/show_bug.cgi?id=9398
25	boklm	82	- https://bugs.mageia.org/show_bug.cgi?id=8172
26	boklm	86	ID: MGAA-2013-0036