document/TranslateProject
2
0
Fork 0
mirror of https://github.com/LCTT/TranslateProject.git synced 2025-01-25 23:11:02 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12101 from Auk7F7/translat

Browse Source 
20181128 Arch-Audit - A Tool To Check Vulnerable Packages In Arch Linux.md
This commit is contained in:
Xingyu.Wang 2019-01-23 21:54:30 +08:00 committed by GitHub
commit fbdb77d956
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 128 additions and 128 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

128
sources/tech/20181128 Arch-Audit - A Tool To Check Vulnerable Packages In Arch Linux.md
View File

@ -1,128 +0,0 @@
[#]: collector: (lujun9972)
[#]: translator: ( Auk7F7)
[#]: reviewer: ( )
[#]: publisher: ( )
[#]: subject: (Arch-Audit : A Tool To Check Vulnerable Packages In Arch Linux)
[#]: via: (https://www.2daygeek.com/arch-audit-a-tool-to-check-vulnerable-packages-in-arch-linux/)
[#]: author: (Prakash Subramanian https://www.2daygeek.com/author/prakash/)
[#]: url: ( )
Arch-Audit : A Tool To Check Vulnerable Packages In Arch Linux
======
We have to make the system up-to date to minimize the downtime and issues.
It’s one of the routine task for Linux administrator to patch the system once in a month or 60 days once or 90 days at maximum.
It would be sufficient schedule and we can’t do it this less than a month as it’s involve multiple activities and environments.
Basically infrastructure comes with Test, Development, QA a.k.a Staging & Prod environments.
Initially we will deploy the patches in the Test environment and corresponding team will be monitoring the system a week then they will give a status report like good or bad.
If it’s success then we will move forward to other environments. If everything is good then finally we will patch production servers.
Many of the organization has prepare to patch entire system. i mean full system update. It is a general patching schedule for a typical infrastructure.
In some of the infrastructure they may have only production environment so, we should not prepare for the full system update instead we can go with security patch to make the system more stable and secure.
Since Arch Linux and its derivatives distributions are fall under rolling release can be considered to be always up-to-date, as it uses the latest versions of software packages from the upstream.
In some cases if you want to update security patch alone then you have to use arch-audit tool to identify and fix the security patches.
### What is a Vulnerability?
A vulnerability is a security weakness in a software program or hardware components (firmware). It’s a flaw that can leave it open to attack.
To mitigate this we need to patch accordingly like for application/hardware it could be a code changes or config changes or parameter changes.
### What is Arch-Audit Tool?
[Arch-audit][1] is a tool like pkg-audit for Arch Linux system. It Uses data collected by the awesome Arch Security Team. It wont scan and find the vulnerable packages on your system like **yum –security check-update & yum updateinfo list available** and it will simply parse the <https://security.archlinux.org/> page and display the results in terminal. So, it would show the accurate data.
The Arch Security Team is a group of volunteers whose goal is to track security issues with Arch Linux packages. All issues are tracked on the Arch Linux security tracker.
The team was formerly known as the Arch CVE Monitoring Team. The mission of the Arch Security Team is to contribute to the improvement of the security of Arch Linux.
### How to Install arch-audit tool in Arch Linux
The arch-audit tool is available in community repository so you can use the Pacman Package Manager to install it.
```
$ sudo pacman -S arch-audit
```
Run the `arch-audit` tool to find the open vulnerable packages on Arch based distributions.
```
$ arch-audit
Package cairo is affected by CVE-2017-7475. Low risk!
Package exiv2 is affected by CVE-2017-11592, CVE-2017-11591, CVE-2017-11553, CVE-2017-17725, CVE-2017-17724, CVE-2017-17723, CVE-2017-17722. Medium risk!
Package libtiff is affected by CVE-2018-18661, CVE-2018-18557, CVE-2017-9935, CVE-2017-11613. High risk!. Update to 4.0.10-1!
Package openssl is affected by CVE-2018-0735, CVE-2018-0734. Low risk!
Package openssl-1.0 is affected by CVE-2018-5407, CVE-2018-0734. Low risk!
Package patch is affected by CVE-2018-6952, CVE-2018-1000156. High risk!. Update to 2.7.6-7!
Package pcre is affected by CVE-2017-11164. Low risk!
Package systemd is affected by CVE-2018-6954, CVE-2018-15688, CVE-2018-15687, CVE-2018-15686. Critical risk!. Update to 239.300-1!
Package unzip is affected by CVE-2018-1000035. Medium risk!
Package webkit2gtk is affected by CVE-2018-4372. Critical risk!. Update to 2.22.4-1!
```
The above result shows the vulnerability risk status as well such as Low, Medium and Critical.
To Show only vulnerable package names and their versions.
```
$ arch-audit -q
cairo
exiv2
libtiff>=4.0.10-1
openssl
openssl-1.0
patch>=2.7.6-7
pcre
systemd>=239.300-1
unzip
webkit2gtk>=2.22.4-1
```
To show only packages that have already been fixed.
```
$ arch-audit --upgradable --quiet
libtiff>=4.0.10-1
patch>=2.7.6-7
systemd>=239.300-1
webkit2gtk>=2.22.4-1
```
To cross check the above results, i’m going to test one of the package which is listed above in <https://www.archlinux.org/packages/> to confirm whether the vulnerability is still open or fixed it. Yes, it’s fixed and published the updated package in repository on yesterday.
![][3]
To print only package names and associated CVEs alone.
```
$ arch-audit -uf "%n|%c"
libtiff|CVE-2018-18661,CVE-2018-18557,CVE-2017-9935,CVE-2017-11613
patch|CVE-2018-6952,CVE-2018-1000156
systemd|CVE-2018-6954,CVE-2018-15688,CVE-2018-15687,CVE-2018-15686
webkit2gtk|CVE-2018-4372
```
--------------------------------------------------------------------------------
via: https://www.2daygeek.com/arch-audit-a-tool-to-check-vulnerable-packages-in-arch-linux/
作者：[Prakash Subramanian][a]
选题：[lujun9972][b]
译者：[译者ID](https://github.com/译者ID)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]: https://www.2daygeek.com/author/prakash/
[b]: https://github.com/lujun9972
[1]: https://github.com/ilpianista/arch-audit
[2]: data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
[3]: https://www.2daygeek.com/wp-content/uploads/2018/11/A-Tool-To-Check-Vulnerable-Packages-In-Arch-Linux.png

128
translated/tech/20181128 Arch-Audit - A Tool To Check Vulnerable Packages In Arch Linux.md Normal file
View File

@ -0,0 +1,128 @@
[#]: collector: "lujun9972"
[#]: translator: " "
[#]: reviewer: " "
[#]: publisher: " "
[#]: subject: "Arch-Audit : A Tool To Check Vulnerable Packages In Arch Linux"
[#]: via: "https://www.2daygeek.com/arch-audit-a-tool-to-check-vulnerable-packages-in-arch-linux/"
[#]: author: "Prakash Subramanian https://www.2daygeek.com/author/prakash/"
[#]: url: " "
Arch-Audit : 一款在 Arch Linux 上检查易受攻击包的工具
======
我们必须经常更新我们的系统以减少宕机时间和问题。
每月给系统打一次补丁，60天一次或者最多90天一次，这是 Linux 管理员的例行任务之一。
这将是忙碌的工作计划，我们不能在不到一个月内做到这一点，因为它涉及到多种活动和环境。
基本上，基础架构与测试、开发、 QA (即分段和产品开发环境)一起提供。
最初，我们会在测试环境中部署补丁，相应的团队将监视系统一周，然后他们将给出一份比如好的或坏的状态报告。
如果它是成功的话，我们将会在其他环境中继续测试，若正常运行，那么最后我们会给生产服务器打上补丁。
许多组织已经准备好给整个系统打上补丁。我的意思是全部系统的更新，这是一种对于基础设施的常规修补计划。
在一些基础结构中，他们可能只有生产环境，因此，我们不应该为完整的系统更新做好准备，而是可以使用安全修补程序来使系统更加稳定和安全。
由于 Arch Linux 及其衍发行版本属于滚动更新版本，因此可以认为他们始终是最新的，因为它使用上游软件包的最新版本。
在某些情况下，如果要单独更新安全修补程序 ，则必须使用 arch-audit 工具来标识和修复安全修补程序。
### 漏洞是什么?
漏洞是软件程序或硬件组件（固件）中的安全漏洞。这是一个可以让它容易受到攻击的缺陷。
为了缓解这种情况，我们需要相应地修补，就像应用程序/硬件一样，它可能是代码更改或配置更改或参数更改。
### Arch-Audit 工具是什么？
[Arch-audit][1] 是一个类似于 Arch Linux 的 pkg-audit 工具。它使用了令人称赞的 Arch 安全小组收集的数据。他不会扫描并发现系统中易受攻击的包，如 **yum –security check-update & yum updateinfo list available**，它只需解析 <https://security.archlinux.org/> 页面并在终端中显示结果，因此，它将显示准确的数据。
Arch 安全小组是一群以跟踪 Arch Linux 软件包的安全问题为目的的志愿者。所有问题都在 Arch 安全追踪者的监视下。.
该小组以前被称为 Arch CVE 监测小组，Arch 安全小组的使命是为提高 Arch Linux 的安全性做出贡献。
### 如何在 Arch Linux 上安装 Arch-Audit 工具
arch-audit 工具已经存在社区源中，所以你可以使用 Pacman 包管理器来安装它。
```
$ sudo pacman -S arch-audit
```
运行 `arch-audit` 工具以查找在基于 Arch 的发行版本上的开放且易受攻击的包。
```
$ arch-audit
Package cairo is affected by CVE-2017-7475. Low risk!
Package exiv2 is affected by CVE-2017-11592, CVE-2017-11591, CVE-2017-11553, CVE-2017-17725, CVE-2017-17724, CVE-2017-17723, CVE-2017-17722. Medium risk!
Package libtiff is affected by CVE-2018-18661, CVE-2018-18557, CVE-2017-9935, CVE-2017-11613. High risk!. Update to 4.0.10-1!
Package openssl is affected by CVE-2018-0735, CVE-2018-0734. Low risk!
Package openssl-1.0 is affected by CVE-2018-5407, CVE-2018-0734. Low risk!
Package patch is affected by CVE-2018-6952, CVE-2018-1000156. High risk!. Update to 2.7.6-7!
Package pcre is affected by CVE-2017-11164. Low risk!
Package systemd is affected by CVE-2018-6954, CVE-2018-15688, CVE-2018-15687, CVE-2018-15686. Critical risk!. Update to 239.300-1!
Package unzip is affected by CVE-2018-1000035. Medium risk!
Package webkit2gtk is affected by CVE-2018-4372. Critical risk!. Update to 2.22.4-1!
```
上述结果显示了系统的脆弱性风险状况，比如：低、中和严重三种情况。
若要仅显示易受攻击的包及其版本，请执行以下操作。
```
$ arch-audit -q
cairo
exiv2
libtiff>=4.0.10-1
openssl
openssl-1.0
patch>=2.7.6-7
pcre
systemd>=239.300-1
unzip
webkit2gtk>=2.22.4-1
```
仅显示已修复的包。
```
$ arch-audit --upgradable --quiet
libtiff>=4.0.10-1
patch>=2.7.6-7
systemd>=239.300-1
webkit2gtk>=2.22.4-1
```
为了交叉检查上述结果，我将测试在 <https://www.archlinux.org/packages/> 列出的一个包以确认漏洞是否仍处于开放状态或已修复。是的，它已经被修复了，并于昨天在社区源中发布了更新后的包。
![][3]
仅打印包名称和其相关的 CVE。
```
$ arch-audit -uf "%n|%c"
libtiff|CVE-2018-18661,CVE-2018-18557,CVE-2017-9935,CVE-2017-11613
patch|CVE-2018-6952,CVE-2018-1000156
systemd|CVE-2018-6954,CVE-2018-15688,CVE-2018-15687,CVE-2018-15686
webkit2gtk|CVE-2018-4372
```
--------------------------------------------------------------------------------
via: https://www.2daygeek.com/arch-audit-a-tool-to-check-vulnerable-packages-in-arch-linux/
作者：[Prakash Subramanian][a]
选题：[lujun9972][b]
译者：[Auk7F7](https://github.com/Auk7F7)
校对：[校对者ID](https://github.com/校对者ID)
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
[a]: https://www.2daygeek.com/author/prakash/
[b]: https://github.com/lujun9972
[1]: https://github.com/ilpianista/arch-audit
[2]: data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7
[3]: https://www.2daygeek.com/wp-content/uploads/2018/11/A-Tool-To-Check-Vulnerable-Packages-In-Arch-Linux.png