AUDIT-SYSTEM(8)

NAME
audit-system - show vulnerabilities in system, utilities and libraries

SYNOPSIS
audit-system [-duv]

DESCRIPTION
The audit-system program compares the programs, utilities, libraries and kernel with the system-vulnerabilities file and reports any known security issues to standard output. This output contains the name and version of the vulnerable component, the type of vulnerability, and a URL for further information for each vulnerability.

The following flags are supported:

-d  audit-system will attempt to download the vulnerabilities file before scanning the system for vulnerabilities.

-u  audit-system will only download the system-vulnerabilities file

-v  Set verbose mode. audit-system will warn when the system vulnerabilities file is more than a week old.

The audit-system program downloads this file from ftp://ftp.NetBSD.org/pub/NetBSD/misc/agc/audit-system/system-vulnerabilities using @FETCH_TOOL@(1). This vulnerabilities file documents all known security issues in NetBSD the system and is kept up-to-date by the NetBSD security-officer team.

Each line lists the component and vulnerable versions, the type of exploit, and an Internet address for further information:

<package pattern> <type> <url>

The type of exploit can be any text, although some common types of exploits listed are:
•   cross-site-html
•   cross-site-scripting
•   denial-of-service
•   file-permissions
•   local-access
•   local-code-execution
•   local-file-read
•   local-file-removal
•   local-file-write
•   local-root-file-view
•   local-root-shell
•   local-symlink-race
•   local-user-file-view
•   local-user-shell
•   privacy-leak
•   remote-code-execution
•   remote-command-inject
•   remote-file-creation
•   remote-file-read
•   remote-file-view
•   remote-file-write
•   remote-key-theft
•   remote-root-access
•   remote-root-shell
•   remote-script-inject
•   remote-server-admin
•   remote-use-of-secret
•   remote-user-access
•   remote-user-file-view
•   remote-user-shell
•   unknown
•   weak-authentication
•   weak-encryption
•   weak-ssl-authentication

By default, the vulnerabilities file is stored in the @SYSVULNDIR@ directory. This can be changed by defining the environment variable SYSVULNDIR to the directory containing the vulnerabilities file.

EXIT STATUS

FILES
@SYSVULNDIR@/system-vulnerabilities

@PKG_SYSCONFDIR@/audit-system.conf

EXAMPLES
The audit-system utility can be run via cron(8) (or with NetBSD's /etc/security.local daily security script).

SEE ALSO
ftp(1), audit-packages(pkgsrc), audit-system.conf(5),

HISTORY
The audit-system command was originally implemented by Alistair Crooks on October 6, 2006.