cxs

Changes:

• During cxs Watch startup default to the POSIX locale to avoid error message ambiguity for intotify from the kernel
• Improvements to –decode ([D]) option
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Improvements to –decode ([D]) option
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Further SECURITY improvements to Quarantine functionality
• All cxs users should upgrade to this release immediately

Changes:

• Fixed a SECURITY BUG in Quarantine file restore which could result in root privilege escalation. The destination restore file must not now exist before restoring will work. Our thanks to Jeff Petersen for reporting this issue
• All cxs users should upgrade to this release immediately

Changes:

• New –options [R]. It will trigger a match for the inbuilt regex used by –options [D] when decoding PHP encoded (base64, etc) scripts
• Improvements to –decode ([D]) option so that both the last and the penultimate decode level are both scanned
• Added improved code for dropping privileges to the “nobody” user while running the interactive php interpreter as root
• Ensure Quarantine only works on files
• Updated UI text for options
• Removed duplicated regex definitions from the database now that –options [R] has been added. Be sure to add R to your –options lists if you specify them if you still want to trap these.

Changes:

• Removed code that dropped privileges to the “nobody” user while running the interactive php interpreter as it broke subsequent scanning at depth
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Improvements to –decode ([D]) option
• New Feature – Added daily check for new Exploit Fingerprints. If cxs is scheduled to check for a new version daily, an additional check for new Exploit Fingerprints released since the last cxs version is performed. These will be downloaded and used on subsequent scans
• Exploit fingerprint definitions database additions

Changes:

• Fixed bug in application type detection introduced in v2.04 which restricted script specific regex detection from working correctly
• Exploit fingerprint definitions database additions

Changes:

• Improvements to –decode [file] – don’t process ignore file
• Speedups for –options [D]
• Speedups for cxs Watch daemon startup
• Fixes to cxs Watch daemon when processing new and –Wadd [file] directories where –ignore [file] and –filemax [num] were not applied
• Improvements to hdir, hfile and hsym processing for –ignore [file]
• Adjustments to –Wloglevel [num]
• Improvements to FTP IP detection