Arch Linux

jsa

Member

Registered: 2009-04-23

Posts: 2

Pacaudit: audit packages

Hello Archers ,

I wrote a small tool which I called Pacaudit.
Pacaudit permits to audit ArchLinux packages installed which are potentially vunerable with last security advisories.
With Pacman/Yaourt, we can have a system up2date but sometimes we don't want to upgrade to the last version because some functionalities are added or deleted. (for applications developers for example)
It can be useful to do the difference between Security Updates and Release Updates (to fix bugs/add features etc..).
Pacaudit is here to scan all packages versions and tell you if one of them match with a security issue.
All Vulnerabilities are in a XML file. It is a beggining..., I just add minimum informations and a possibility to compare versions or match versions with regex expressions.
It is very easy to add new vulnerability:

<vuln id="X">
<title></title>
<advisory></advisory>
<description></description>
<date></date>
<product></product>
<operator></operator>  ( 2 choices less or match)
<version></version> 
</vuln>

Example:

[jsa@mybox pacaudit]$ ./pacaudit 
PACAUDIT started ... 
  x Softwares Inventory... 
  x Audit Installed Packages... 

xxx => No Vulnerability found on your system

or
[jsa@mybox pacaudit]$ ./pacaudit 
PACAUDIT started ... 
  x Softwares Inventory... 
  x Audit Installed Packages... 
---------- 
x Vulnerability found for : 

xxx poppler package
xxxxx title: Poppler Multiple Vulnerabilities 
xxxxx url: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1188 
---------- 
**************** 
PACAUDIT RESULTS 
---------------- 
Total: 1 vuln found on your system

Sure, this tool is here to be improve so I saw on the forum, some persons are interested in Security so If you want to participate to this project (write new vuln etc..) contact me on forum/pm/irc/mail etc..
Dependencies: perl with perl-xml-simple package
URL: http://code.google.com/p/pacaudit/

Best Regards
JSA

ndowens

Member

Registered: 2007-08-15

Posts: 39

Website

Re: Pacaudit: audit packages

could put it on aur

---

My site: ndowens.tk

u_no_hu

Member

Registered: 2008-06-15

Posts: 453

Re: Pacaudit: audit packages

How do you plan to keep the database/XML file updated ? Is it syncing with any vulnerability database?

---

Don't be a HELP VAMPIRE. Please search before you ask.

Subscribe to The Arch Daily News.

jsa

Member

Registered: 2009-04-23

Posts: 2

Re: Pacaudit: audit packages

Most of Archlinux Users tell me that this software is not necessary for Archlinux because Archlinux is already up2date.
So I stop the idea and I use it in private mode.
Best Regards