rootkit error log

[betoranaldi]

I just started checking the rootkit error log and noticed I should update a few things.

There seems to be a few items I don't know how to update/fix

anyone familiar with these?

[00:16:09] /bin/mount Hash NOT valid (My MD5: 1d90a1529ef1e40f2f5ce2bcd4f17145, expected: 9b47d3a9e4ef3f5af98d7496a04b1938)
[00:16:09] /bin/netstat Hash NOT valid (My MD5: 0d219306a39b315e2a3472f703c3275e, expected: 21d52be31b7242bd2a8a2d05ec4069d3)
[00:16:10] /bin/ps Hash NOT valid (My MD5: 955a1df417c344cbd5165c463ade4298, expected: 27f72f16856104734aa7d6ee94f458a2)
[00:16:10] /sbin/ifconfig Hash NOT valid (My MD5: 2414d669ab6ed5b49a081321d46d4a0a, expected: 5f3062e2c86cb8412b0d582e1077df22)
[00:16:11] /sbin/sysctl Hash NOT valid (My MD5: b518e5d12f30a0022daea7fe3d55e0a9, expected: a269b042a00aee6fde8f454fd0fe57b0)
[00:16:12] /usr/bin/kill Hash NOT valid (My MD5: 13fe6a13c923cc9176e8c33349c4b4dc, expected: 350e72bead1546b5378bda3be274faac)
[00:16:12] /usr/bin/kill Hash NOT valid (My MD5: 13fe6a13c923cc9176e8c33349c4b4dc, expected: f969b832d75f05ad93fbd5f2a67e41c7)
[00:16:12] MD5 hash for my file (/usr/bin/kill) is 13fe6a13c923cc9176e8c33349c4b4dc, but is not in database
[00:16:14] /usr/bin/w Hash NOT valid (My MD5: a0d9a0f22b1dbf75439909dd3ba21a93, expected: bfca622c9f218e3f29268153b46a49e2)
[00:16:14] /usr/bin/watch Hash NOT valid (My MD5: 89a78afb5eddc69b8dfcc72d981784c1, expected: 944c2034d82f09d633e810c0d5817f41)

and finally

[00:17:48] Scanning GnuPG...
[00:17:48] /usr/bin/gpg found
[00:17:48] Version 1.2.4 seems to be vulnerable (if unpatched)!

as for the last error i tried running yup update gnupg and it says it is up to date.

Anyone have any suggestions how i should proceed?

 

[nobaloney]

What OS Distribution are you using? Most package based updates keep old names and old versions (to keep dependency issues to a minimum) but backport fixes.

To confound the issue further, DA doesn't use packages for many of it's programs; instead it build from source. So any rootkit program you run may have to be customized for the OS Distribution you're running; possible even for DA.

Jeff

 

[betoranaldi]

its a Centos 4 box.

Makes sense that I wouldn't know what the custom packages are. I will just ignore it.

Thank you for your response.

-Brian