← All KD5FMU repositories
Supermon-7.4-Backup-Repository
https://github.com/KD5FMU/Supermon-7.4-Backup-Repository
· Shell · 3 findings · Review date 2026-07-11
Executive Summary
Both install scripts download Supermon tarballs over plain HTTP without checksum verification.
Supermon - Monitor / Manager Supermon@groups.io https://groups.io/g/Supermon
Summary Counts
Quick Reference
| ID | Severity | Category | File | Lines | Finding |
|---|
| SUPERMON-001 |
High |
Security |
supermonASL_fresh_install.sh |
40-41 |
Fresh install downloads tarball over HTTP without verification |
| SUPERMON-002 |
High |
Security |
supermonASL_latest_update.sh |
20-24 |
Latest update downloads tarball over HTTP without verification |
| SUPERMON-003 |
Medium |
Security |
supermonASL_fresh_install.sh |
43-45 |
Installer chmod makes syslog and apache logs world-readable |
High Security Issues
[SUPERMON-001] Fresh install downloads tarball over HTTP without verification
supermonASL_fresh_install.sh : 40-41
wget http://198.58.124.150/sm74/SupermonASL-fresh-install.tgz then tar to /.
Impact: MITM supplies malicious tarball extracted as root.
[SUPERMON-002] Latest update downloads tarball over HTTP without verification
supermonASL_latest_update.sh : 20-24
wget SupermonASL-latest.tgz and tar extracts to /.
Impact: Compromised update server replaces Supermon files.
Medium Issues
[SUPERMON-003] Installer chmod makes syslog and apache logs world-readable
supermonASL_fresh_install.sh : 43-45
chmod +r on /var/log/syslog* and apache logs.
Impact: Local users can read sensitive operational logs.
Recommended Fix Priority
- Use HTTPS with checksum verification for remote downloads