bigfix-duke

maintainer crazyboycjr · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads masthead.afxm via wget from http://bf01.aas.duke.edu:52311 during the package() function, outside the source array and without any checksum verification. While this appears to be an institutional BigFix server at Duke University (BigFix uses port 52311 for its relay/server), the file is fetched over plain HTTP with no integrity check, and it is installed as a configuration file into /etc/opt/BESClient/actionsite.afxm. This file controls which BigFix management server the agent trusts and connects to — a tampered masthead could redirect the agent to a malicious management server with full remote code execution capability over the managed host. The unverified runtime download from an unofficial/institutional host with no checksum is a genuine supply-chain concern, even if the intent is legitimate. The primary source also comes from a private SCP server (danyang-01.cs.duke.edu), which is non-standard but has a checksum. The combination of an unverified HTTP download of a security-critical configuration file during packaging warrants a MEDIUM rating.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 wget -nc http://bf01.aas.duke.edu:52311/masthead/masthead.afxm

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads masthead.afxm via wget from http://bf01.aas.duke.edu:52311 during the package() function, outside the source array and without any checksum verification. While this appears to be an institutional BigFix server at Duke University (BigFix uses port 52311 for its relay/server), the file is fetched over plain HTTP with no integrity check, and it is installed as a configuration file into /etc/opt/BESClient/actionsite.afxm. This file controls which BigFix management server the agent trusts and connects to — a tampered masthead could redirect the agent to a malicious management server with full remote code execution capability over the managed host. The unverified runtime download from an unofficial/institutional host with no checksum is a genuine supply-chain concern, even if the intent is legitimate. The primary source also comes from a private SCP server (danyang-01.cs.duke.edu), which is non-standard but has a checksum. The combination of an unverified HTTP download of a security-critical configuration file during packaging warrants a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jingrong Chen <crazyboycjr@gmail.com>
    
      2pkgname=bigfix-duke
    
      3pkgver=10.0.2.52
    
      4pkgrel=2
    
      5pkgdesc="BigFix Enterprise Suite for Duke"
    
      6arch=('x86_64')
    
      7license=('unknown')
    
      8depends=('net-tools' 'bash' 'start-stop-daemon')
    
      9# BigFix_CS_10.0.2.52_Linux.zip is on a private server. Please replace this with your prepared material.
    
      10# You can acquire one copy here: https://www2.cs.duke.edu/csl/endpoints/BigFix_CS_10.0.2.52_Linux.zip
    
      11source=('scp://danyang-01.cs.duke.edu:/nfs/public/csl_endpoints/BigFix_CS_10.0.2.52_Linux.zip'
    
      12        'besclient.service'
    
      13        'vars.sh'
    
      14        'init-functions')
    
      15sha256sums=('c3410a3a7a97d4ee10cca0a2d8990c9c23758a3b1a0472d108d66921df83a088'
    
      16            '777f36b8b3944136b957280b05d5f1ad133f66b62486028a1a687f14de284416'
    
      17            'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
    
      18            '3e0428b8665bb91a9783386ceef42f7e67e330f9db25a107c7131239c7e07405')
    
      19install='bigfix.install'
    
      20
    
      21package() {
    
      22    builtin cd "${srcdir}/BigFix_CS_10.0.2.52_Linux"
    
      23
    
      24	# NOTE: Replace this file with your own verified copy.
    
      25    wget -nc http://bf01.aas.duke.edu:52311/masthead/masthead.afxm
    
      26    install -Dm644 masthead.afxm "${pkgdir}/etc/opt/BESClient/actionsite.afxm"
    
      27    install -Dm644 besclient.config -t "${pkgdir}/var/opt/BESClient/"
    
      28
    
      29	# Use the file from ubuntu deb file.
    
      30    mkdir -p deb
    
      31    ar -x BESAgent-10.0.2.52-ubuntu10.amd64.deb --output deb
    
      32    tar xzvfp deb/data.tar.gz -C "${pkgdir}" --no-same-owner 
    
      33    mkdir -p "${pkgdir}/usr"
    
      34    mv "${pkgdir}/lib" "${pkgdir}/usr/lib"
    
      35
    
      36    install -Dm644 "${startdir}/besclient.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      37    install -Dm644 "${startdir}/vars.sh" "${pkgdir}/usr/lib/init/vars.sh"
    
      38    install -Dm644 "${startdir}/init-functions" "${pkgdir}/usr/lib/lsb/init-functions"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2