rootkit hunter error MD5 in /sbin/ip ??

i've tested a suse9.1 system with rkhunter.

it reports all clean except an md5 error in /sbin/ip.

i,ve reinstalled the package iproute2 (which contains /sbin/ip) and the
problem is solved, the computer was compromised?

thanks

Fernando Peral wrote:
> i've tested a suse9.1 system with rkhunter.
>
> it reports all clean except an md5 error in /sbin/ip.
>
> i,ve reinstalled the package iproute2 (which contains /sbin/ip) and the
> problem is solved, the computer was compromised?

Not necessarily. It just means that the MD5 sum didn't match what was
expected. As far as you know, it could have just been corrupt.

--
Sean

Fao, Sean wrote:
> Fernando Peral wrote:
>
>> i've tested a suse9.1 system with rkhunter.
>>
>> it reports all clean except an md5 error in /sbin/ip.
>>
>> i,ve reinstalled the package iproute2 (which contains /sbin/ip) and the
>> problem is solved, the computer was compromised?
>
>
> Not necessarily. It just means that the MD5 sum didn't match what was
> expected. As far as you know, it could have just been corrupt.

After updating my Fedora Core 3 a lot of binaries showed MD5 errors
with rkhunter. After doing an rkhunter --update now it doesn't show
any errors.

Regards.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(E-Mail Removed)
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"