Merge lp:~sbeattie/ubuntu/natty/logwatch/logwatch-fixups into lp:ubuntu/natty/logwatch

[Steve Beattie]

Security update for CVE-2011-1018 (submitted to debian, debian bug 615995), fixes for bug 719898, bug 584229, and bug 564796.

[Martin Pitt (pitti)]

This looks fine, thanks!

review: Approve

=== modified file 'debian/changelog'
--- debian/changelog	2010-09-06 14:57:14 +0000
+++ debian/changelog	2011-03-01 21:01:38 +0000
@@ -1,3 +1,20 @@
+logwatch (7.3.6.cvs20090906-1ubuntu4) natty; urgency=low
+
+  * SECURITY UPDATE: privileged code execution via badly named logfiles
+    - scripts/logwatch.pl: encapsulate logfiles in 's and ensure logfile
+      names don't contain '.
+    - http://logwatch.svn.sourceforge.net/viewvc/logwatch?view=revision&revision=26
+    - CVE-2011-1018
+  * debian/dist.conf/services/cron.conf: adjust to capture cron entries,
+    thanks to Oliver Brakmann (LP: #719898)
+  * scripts/services/named: update to upstream version to correctly
+    capture more information (LP: #584229)
+    - http://logwatch.svn.sourceforge.net/viewvc/logwatch/scripts/services/named?revision=19
+  * logwatch.8: replace examples containing obsolete --print argument
+    with --output=stdout (LP: #564796)
+
+ -- Steve Beattie <[e-mail]>  Tue, 01 Mar 2011 12:00:08 -0800
+
 logwatch (7.3.6.cvs20090906-1ubuntu3) maverick; urgency=low
 
   * conf/logfiles/*, debian/dist.conf/logfiles/*:

=== modified file 'debian/dist.conf/services/cron.conf'
--- debian/dist.conf/services/cron.conf	2005-11-19 16:39:24 +0000
+++ debian/dist.conf/services/cron.conf	2011-03-01 21:01:38 +0000
@@ -1,3 +1,3 @@
 LogFile = syslog
-*OnlyService = (CROND|\/USR\/SBIN\/CRON|\/usr\/sbin\/cron)
+*OnlyService = (CRON|cron|CROND|\/USR\/SBIN\/CRON|\/usr\/sbin\/cron)
 

=== modified file 'logwatch.8'
--- logwatch.8	2009-10-05 09:20:31 +0000
+++ logwatch.8	2011-03-01 21:01:38 +0000
@@ -66,7 +66,6 @@
 .IP "\fB--mailto\fR address"
 Mail the results to the email address or user specified in
 .I address.
-This option overrides the \-\-print option.
 .IP "\fB--range\fR range"
 You can specify a date-range to process. Common ranges are  
 .I Yesterday, Today, All,
@@ -121,12 +120,12 @@
 information.
 .RE
 .SH EXAMPLES
-.B logwatch --service ftpd-xferlog --range all --detail high --print --archives
+.B logwatch --service ftpd-xferlog --range all --detail high --output=stdout --archives
 .RS
 This will print out all FTP transfers that are stored in all current and archived
 xferlogs.
 .RE
-.B logwatch --service pam_pwdb --range yesterday --detail high --print
+.B logwatch --service pam_pwdb --range yesterday --detail high --output=stdout
 .RS
 This will print out login information for the previous day...
 .RE

=== modified file 'scripts/logwatch.pl'
--- scripts/logwatch.pl	2009-10-05 09:20:31 +0000
+++ scripts/logwatch.pl	2011-03-01 21:01:38 +0000
@@ -738,6 +738,10 @@
    my $DestFile =  $TempDir . $LogFile . "-archive";
    my $Archive;
    foreach $Archive (@{$LogFileData{$LogFile}{'archives'}}) {
+      if ($Archive =~ /'/) {
+         print "File $Archive has invalid embedded quotes.  File ignored.\n";
+	 next;
+      }
       my $CheckTime;
       # We need to find out what's the earliest log we need
       my @time_t = TimeBuild();
@@ -765,15 +769,15 @@
       my @FileStat = stat($Archive);
       if ($CheckTime <= ($FileStat[9])) {
          if (($Archive =~ m/gz$/) && (-f "$Archive") && (-s "$Archive")) {
-            my $arguments = "$Archive >> $DestFile";
+            my $arguments = "'${Archive}' >> $DestFile";
             system("$Config{'pathtozcat'} $arguments") == 0
                or die "system '$Config{'pathtozcat'} $arguments' failed: $?" 
          } elsif (($Archive =~ m/bz2$/) && (-f "$Archive") && (-s "$Archive")) {
-            my $arguments = "$Archive 2>/dev/null >> $DestFile";
+            my $arguments = "'${Archive}' 2>/dev/null >> $DestFile";
             system("$Config{'pathtobzcat'} $arguments") == 0
                or die "system '$Config{'pathtobzcat'} $arguments' failed: $?" 
          } elsif ((-f "$Archive") && (-s "$Archive")) {
-            my $arguments = "$Archive  >> $DestFile";
+            my $arguments = "'${Archive}'  >> $DestFile";
             system("$Config{'pathtocat'} $arguments") == 0
                or die "system '$Config{'pathtocat'} $arguments' failed: $?" 
          } #End if/elsif existence
@@ -785,6 +789,10 @@
    foreach my $ThisFile (@FileList) {
       #Existence check for files -mgt
       next unless (-f $ThisFile);
+      if ($ThisFile =~ /'/) {
+         print "File $ThisFile has invalid embedded quotes.  File ignored.\n";
+	 next;
+      }
       if (! -r $ThisFile) {
          print "File $ThisFile is not readable.  Check permissions.";
          if ($> != 0) {
@@ -794,7 +802,7 @@
          next;
       }
       #FIXME - We have a bug report for filenames with spaces, can be caught here needs test -mgt
-      $FileText .= ($ThisFile . " ");
+      $FileText .= ("'" . $ThisFile . "' ");
    } #End foreach ThisFile
 
    # remove the ENV entries set by previous service

=== modified file 'scripts/services/named'
--- scripts/services/named	2009-10-05 09:20:31 +0000
+++ scripts/services/named	2011-03-01 21:01:38 +0000
@@ -1,7 +1,22 @@
 ##########################################################################
-# $Id: named,v 1.58 2009/06/02 14:55:45 mike Exp $
+# $Id: named,v 1.62 2011/01/06 22:53:00 stefan Exp $
 ##########################################################################
 # $Log: named,v $
+# Revision 1.62 2011/01/06 22:53:00  stefan
+# add: deferred zone transfers 
+# fix: TTL differs in rdataset
+#
+# Revision 1.61 2010/09/18 17:35:00  stefan
+# add: bad zone transfer request
+#
+# Revision 1.60 2010/05/10 00:25:00  stefan
+# fix: clients-per-query, 
+# add: more lines to ignore, refused notify, client query denied, retry 
+#   limit exceeded, too many open file, no SOA, checkhints
+#
+# Revision 1.59.1 2010/05/04 22:25:00  stefan
+# More refresh: and RCODE handling
+#
 # Revision 1.58  2009/06/02 14:55:45  mike
 # Fedora patch from Ivan Varekova -mgt
 #
@@ -110,7 +125,7 @@
 ## Logwatch project reserves the right to not accept such
 ## contributions.  If you have made significant
 ## contributions to this script and want to claim
-## copyright please contact [e-mail].
+## copyright please contact [e-mail].
 #########################################################
 
 use Logwatch ':ip';
@@ -199,11 +214,11 @@
       ($ThisLine =~ /binding TCP socket: address in use/) or
       ($ThisLine =~ /dbus_mgr initialization failed. D-BUS service is disabled./) or
       ($ThisLine =~ /dbus_svc_add_filter failed/) or
-      ($ThisLine =~ /isc_log_open 'named.run' failed: permission denied/) or 
-      ($ThisLine =~ /weak RSASHA1 \(5\) key found \(exponent=3\)/) or 
-      ($ThisLine =~ /Bad file descriptor/) or 
+      ($ThisLine =~ /isc_log_open 'named.run' failed: permission denied/) or
+      ($ThisLine =~ /weak RSASHA1 \(5\) key found \(exponent=3\)/) or
+      ($ThisLine =~ /Bad file descriptor/) or
       ($ThisLine =~ /open: .*: file not found/) or
-      ($ThisLine =~ /queries: client [0-9.#:]* view localhost_resolver: query: .* IN .*/) or
+      ($ThisLine =~ /queries: client [\.0-9a-fA-F#:]* view localhost_resolver: query: .* IN .*/) or
       ($ThisLine =~ /zone .*: NS '.*' is a CNAME \(illegal\)/) or
       ($ThisLine =~ /zone .*: zone serial unchanged. zone may fail to transfer to slaves/) or
       ($ThisLine =~ /zone .*: loading from master file .* failed/) or
@@ -212,8 +227,30 @@
       ($ThisLine =~ /.*: unexpected end of input/) or
       ($ThisLine =~ /too many timeouts resolving '.*' .*: disabling EDNS/) or
       ($ThisLine =~ /too many timeouts resolving '.*' .*: reducing the advertised EDNS UDP packet size to .* octets/) or
-      ($ThisLine =~ /reloading zones succeeded/)
-      # too many timeouts resolving 'ns-ext.nrt1.isc.org/AAAA' (in '.'?): disabling EDNS: 3 Time(s)
+      ($ThisLine =~ /reloading zones succeeded/) or
+      ($ThisLine =~ /success resolving '.*' \(in '.*'?\) after disabling EDNS/) or
+      ($ThisLine =~ /success resolving '.*' \(in '.*'?\) after reducing the advertised EDNS UDP packet size to 512 octets/) or
+      ($ThisLine =~ /the working directory is not writable/) or
+      ($ThisLine =~ /using default UDP\/IPv[46] port range: \[[0-9]*, [0-9]*\]/) or
+      ($ThisLine =~ /adjusted limit on open files from [0-9]* to [0-9]*/) or
+      ($ThisLine =~ /using up to [0-9]* sockets/) or
+      ($ThisLine =~ /built with/) or
+      ($ThisLine =~ /TTL differs in rdataset, adjusting [0-9]* -> [0-9]*/) or
+      ($ThisLine =~ /max open files \([0-9]*\) is smaller than max sockets \([0-9]*\)/) or
+      ($ThisLine =~ /clients-per-query (?:de|in)creased to .*/) or
+      ($ThisLine =~ /^must-be-secure resolving '.*': .*/) or
+      ($ThisLine =~ /^(error \()?no valid (DS|KEY|RRSIG)\)? resolving '.*': .*/) or
+      ($ThisLine =~ /^not insecure resolving '.*': .*/) or
+      ($ThisLine =~ /^validating \@0x[[:xdigit:]]+: .* DS: must be secure failure/) or
+      ($ThisLine =~ /^(error \()?broken trust chain\)? resolving '.*': .*/) or
+      ($ThisLine =~ /journal file [^ ]* does not exist, creating it/) or
+      ($ThisLine =~ /serial number \(\d+\) received from master/) or
+      ($ThisLine =~ /zone is up to date/) or
+      ($ThisLine =~ /refresh in progress, refresh check queued/) or
+      ($ThisLine =~ /refresh: NODATA response from master/) or
+      ($ThisLine =~ /update with no effect/) or
+      # ignore this line because the following line describes the error
+      ($ThisLine =~ /unexpected error/)
    ) {
       # Don't care about these...
    } elsif (
@@ -234,6 +271,8 @@
       $ShutdownNamedFail++;
    } elsif ( ($Host, $Zone) = ( $ThisLine =~ /client ([^\#]+)#[^\:]+: zone transfer '(.+)' denied/ ) ) {
       $DeniedZoneTransfers{$Host}{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /zone (.+) zone transfer deferred due to quota/ ) ) {
+      $DeferredZoneTransfers{$Zone}++;
    } elsif ( ($Zone) = ( $ThisLine =~ /cache zone \"(.*)\" loaded/ ) ) {
       $ZoneLoaded{"cache $Zone"}++;
    } elsif ( ($Zone) = ( $ThisLine =~ /cache zone \"(.*)\" .* loaded/ ) ) {
@@ -260,6 +299,11 @@
       $ZoneReceivedNotify{$Zone}++;
    } elsif ( ($Zone) = ( $ThisLine =~ /zone (.*): notify from .* up to date/ ) ) {
       $ZoneReceivedNotify{$Zone}++;
+   } elsif ( ($Zone) = ( $ThisLine =~ /zone (.+)\/IN: refused notify from non-master/ ) ) {
+      $ZoneRefusedNotify{$Zone}++;
+#   } elsif ( ($Rhost,$Ldom,$Reason) = ( $ThisLine =~ /client ([\d\.a-fA-F:]+) bad zone transfer request: '(.+)': (.+)$/ ) ) {
+   } elsif ( ($Rhost,$Ldom,$Reason) = ( $ThisLine =~ /client ([\.0-9a-fA-F:]+)#\d+: bad zone transfer request: '(.+)\/IN': (.+)/ ) ) {
+      $BadZone{$Reason}{"$Rhost ($Ldom)"}++;
    } elsif ( ($Host) = ( $ThisLine =~ /([^ ]+) has CNAME and other data \(invalid\)/ ) ) {
       push @CNAMEAndOther, $Host;
    } elsif ( ($File,$Line,$Entry,$Error) = ( $ThisLine =~ /dns_master_load: ([^:]+):(\d+): ([^ ]+): (.+)$/ ) ) {
@@ -280,7 +324,10 @@
    } elsif ( ($Client) = ( $ThisLine =~ /client (.*)#\d+: query \(cache\) denied/ ) ) {
       $FullClient = LookupIP ($Client);
       $DeniedQuery{$FullClient}++;
-   } elsif ( ($Rhost, $ViewName, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+:(?: view ([^ ]+):)? update '(.*)' denied/)) {
+   } elsif ( ($Client) = ( $ThisLine =~ /client (.*)#\d+: query '.*\/IN' denied/ ) ) {
+      $FullClient = LookupIP ($Client);
+      $DeniedQueryNoCache{$FullClient}++;
+   } elsif ( ($Rhost, $ViewName, $Ldom) = ($ThisLine =~ /client ([\.0-9a-fA-F:]+)#\d+:(?: view ([^ ]+):)? update '(.*)' denied/)) {
       $ViewName = ($ViewName ? "/$ViewName" : "");
       $UpdateDenied{"$Rhost ($Ldom$ViewName)"}++;
    } elsif ( ($Rhost, $Ldom) = ($ThisLine =~ /client ([\d\.]+)#\d+: update forwarding '(.*)' denied/)) {
@@ -297,9 +344,12 @@
       $MasterFailure{"$Zone from $Host"}{$Reason}++;
    } elsif ( ($Zone) = ($ThisLine =~ /zone ([^\/]+)\/.+: refresh: non-authoritative answer from master/)) {
       $NonAuthoritative{$Zone}++;
-   } elsif ( ($ThisLine =~ /unexpected RCODE \((.*)\) resolving/) ){
+   } elsif ( ($Zone) = ($ThisLine =~ /zone ([^\/]+)\/.+: refresh: retry limit for master \S+ exceeded/) ) {
+      $RetryLimit{$Zone}++; 
+   } elsif ( ($ThisLine =~ /(?:error \()?unexpected RCODE\)? \(?(.*?)\)? resolving/) ){
       $UnexpRCODE{$1}++;
-   } elsif ( ($ThisLine =~ /FORMERR resolving '[^ ]+: [0-9.#]+/) ) {
+   } elsif ( ($ThisLine =~ /(?:error \()?FORMERR\)? resolving '[^ ]+: [.0-9a-fA-F:#]+/) or
+             ($ThisLine =~ /DNS format error from [^ ]+ resolving [^ ]+( for client [^ ]+)?: .*/) ) {
       chomp($ThisLine);
       $FormErr{$ThisLine}++;
    } elsif ( ($ThisLine =~ /found [0-9]* CPU(s)?, using [0-9]* worker thread(s)?/) ) {
@@ -314,7 +364,10 @@
 	     (($ErrorText) = ($ThisLine =~ /^(.* REQUIRE.* failed.*)$/)) or
 	     (($ErrorText) = ($ThisLine =~ /(.*: fatal error)/)) ) {
       $NError{$ErrorText}++;
-   } elsif ( ($From,$Log) = ($ThisLine =~ /invalid command from ([.0-9]*)#[0-9]*: (.*)/) ) {
+   } elsif ( (($ErrorText) = ($ThisLine =~ /^(internal_accept: fcntl\(\) failed: Too many open files)/)) or
+             (($ErrorText) = ($ThisLine =~ /^(socket: too many open file descriptors)/)) ) {
+      $ErrOpenFiles{$ErrorText}++;
+   } elsif ( ($From,$Log) = ($ThisLine =~ /invalid command from ([\.0-9a-fA-F:]*)#[0-9]*: (.*)/) ) {
       $CCMessages{"$From,$Log"}++;
    } elsif ( (($Log) = ($ThisLine =~ /(freezing .*zone.*)/)) or
 	     (($Log) = ($ThisLine =~ /(thawing .*zone.*)/)) ) {
@@ -323,14 +376,18 @@
       $UnknownCCCommands{$CCC}++;
    } elsif (($CCC) = ($ThisLine =~ /received control channel command '(.*)'/)) {
       $CCCommands{$CCC}++;
-   } elsif (($Name,$Address) = ($ThisLine =~ /network unreachable resolving '(.*)': (.*)/)) {
+   } elsif (($Name,$Address) = ($ThisLine =~ /(?:error \()?network unreachable\)? resolving '(.*)': (.*)/)) {
       $NUR{$Name}{$Address}++;
-   } elsif (($Name,$Address) = ($ThisLine =~ /host unreachable resolving '(.*)': (.*)/)) {
+   } elsif (($Name,$Address) = ($ThisLine =~ /(?:error \()?host unreachable\)? resolving '(.*)': (.*)/)) {
       $HUR{$Name}{$Address}++;
+   } elsif (($Client) = ($ThisLine =~ /client ([\da-fA-F.:]+)(?:#\d*:)? notify question section contains no SOA/)) {
+      $NoSOA{$Client}++;
+   } elsif (($Hint) = ($ThisLine =~ /checkhints: (.*)/) ) {
+      $Hints{$Hint}++;
    } else {
       # Report any unmatched entries...
       # remove PID from named messages
-      $ThisLine =~ s/(client [.0-9]+)\S+/$1/;
+      $ThisLine =~ s/(client [\.0-9a-fA-F:]+)\S+/$1/;
       chomp($ThisLine);
       $OtherList{$ThisLine}++;
    }
@@ -368,6 +425,13 @@
    }
 }
 
+if ( ( $Detail >= 5 ) and (keys %ZoneRefusedNotify) ) {
+   print "\nZones refused notify:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %ZoneRefusedNotify) {
+      print "   $ThisOne: $ZoneRefusedNotify{$ThisOne} Time(s)\n";
+   }
+}
+
 if ( ($Detail >= 5) and (keys %ChannelAddFail) ) {
    print "\nCan't add command channel:\n";
    foreach $Channel (sort {$a cmp $b} keys %ChannelAddFail) {
@@ -383,7 +447,7 @@
    foreach $Zone (sort {$a cmp $b} keys %MasterFailure) {
       print "   $Zone:\n";
       foreach $Reason (sort {$a cmp $b} keys %{$MasterFailure{$Zone}}) {
-         print "      $Reason: $MasterFailure{$Zone}{$Reason}++ Time(s)\n";
+         print "      $Reason: $MasterFailure{$Zone}{$Reason} Time(s)\n";
       }
    }
 }
@@ -395,7 +459,13 @@
       foreach my $Zone (keys %{$DeniedZoneTransfers{$Host}}) {
          print "      $Zone: $DeniedZoneTransfers{$Host}{$Zone} Time(s)\n";
       }
-      print "\n";
+   }
+}
+
+if ( ( $Detail >= 5 ) and (keys %DeferredZoneTransfers) ) {
+   print "\nDeferred Zone Transfers:\n";
+   foreach my $Zone (keys %DeferredZoneTransfers) {
+      print "   $Zone: $DeferredZoneTransfers{$Zone} Time(s)\n";
    }
 }
 
@@ -416,6 +486,16 @@
    }
 }
 
+if ( ( $Detail >= 10 ) and (keys %BadZone) ) {
+   print "\nBad Zone Transfer Request:\n";
+   foreach $Reason (keys %BadZone) {
+      print "   Reason: $Reason\n";
+      foreach $ThisOne (sort {$a cmp $b} (keys %{$BadZone{$Reason}}) ) {
+         print "      $ThisOne: $BadZone{$Reason}{$ThisOne} Time(s)\n";
+      }
+   }
+}
+
 if ( ( $Detail >= 5 ) and (keys %DeniedTCPClient) ) {
    print "\nno more TCP clients warning:\n";
    foreach $ThisOne (keys %DeniedTCPClient) {
@@ -424,12 +504,19 @@
 }
 
 if ( ( $Detail >= 5 ) and (keys %DeniedQuery) ) {
-   print "\nQueries (cache) that were denied:\n";
+   print "\nQueries (cached) that were denied:\n";
    foreach $ThisOne (keys %DeniedQuery) {
       print "   from $ThisOne: $DeniedQuery{$ThisOne} Time(s)\n";
    }
 }
 
+if ( ( $Detail >= 10 ) and (keys %DeniedQueryNoCache) ) {
+   print "\nQueries (not cached) that were denied:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %DeniedQueryNoCache) {
+      print "   from $ThisOne: $DeniedQueryNoCache{$ThisOne} Time(s)\n";
+   }
+}
+
 if ( ( $Detail >= 10 ) and (@CNAMEAndOther) ) {
    print "\nThese hosts have CNAME and other data (invalid):\n";
    foreach $ThisOne (@CNAMEAndOther) {
@@ -461,13 +548,27 @@
    }
 }
 
+if ( ($Detail >= 10) and (keys %RetryLimit) ) {
+   print "\nRetry limit exceeded for these zones:\n";
+   foreach $Zone (sort {$a cmp $b} keys %RetryLimit) {
+      print "   $Zone: $RetryLimit{$Zone} Time(s)\n";
+   }
+}
+
+if ( ($Detail >= 10) and (keys %NoSOA) ) {
+   print "\nNotify question sections of these clients contained no SOA:\n";
+   foreach $Client (sort {$a cmp $b} keys %NoSOA) {
+      print "   $Client: $NoSOA{$Client} Time(s)\n";
+   }
+}
+
 if ( ( $Detail >= 10 ) and (keys %NetworkUnreachable) ) {
    print "\nNetwork is unreachable for:\n";
    foreach $ThisOne (sort {$a cmp $b} keys %NetworkUnreachable) {
       print "   $ThisOne:\n";
       foreach $Host (sort {$a cmp $b} keys %{$NetworkUnreachable{$ThisOne}}) {
          print "      $Host: $NetworkUnreachable{$ThisOne}{$Host} Time(s)\n";
-      } 
+      }
    }
 }
 
@@ -497,7 +598,7 @@
       print "   $ThisOne:\n";
       foreach $Message (sort {$a cmp $b} keys %{$ZoneUpdates{$ThisOne}}) {
          print "      $Message: $ZoneUpdates{$ThisOne}{$Message} Time(s)\n";
-      } 
+      }
    }
 }
 
@@ -576,6 +677,14 @@
    }
 }
 
+if (keys %ErrOpenFiles) {
+   print "\n The following seams to be caused by the patches for CVE-2008-1447.";
+   print "\n Please update your bind.\n";
+   foreach $ThisOne (keys %ErrOpenFiles) {
+      print "   " . $ThisOne . ": " . $ErrOpenFiles{$ThisOne} . " Time(s)\n";
+   }
+}
+
 if ((keys %CCMessages) or (keys %CCMessages2)){
    print "\n Messages from control channel\n";
    foreach (keys %CCMessages) {
@@ -594,7 +703,14 @@
    }
    foreach $ThisOne (keys %UnknownCCCommands) {
       print "   " . $ThisOne . "(unknown command): " . $CCCommands{$ThisOne} . " Time(s)\n";
-   }               
+   }
+}
+
+if (keys %Hints) {
+   print "\nCheckhints:\n";
+   foreach $ThisOne (sort {$a cmp $b} keys %Hints) {
+      print "   " .$ThisOne .": $Hints{$ThisOne} Time(s)\n";
+   }
 }
 
 if (keys %OtherList) {
@@ -607,4 +723,8 @@
 exit(0);
 
 # vi: shiftwidth=3 tabstop=3 syntax=perl et
-
+# Local Variables:
+# mode: perl
+# perl-indent-level: 3
+# indent-tabs-mode: nil
+# End: