[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Jul 2011 22:48:17 -0700
From: Chris Evans <scarybeasts@...il.com>
To: HD Moore <hdm@...italoffense.net>
Cc: Solar Designer <solar@...nwall.com>, oss-security@...ts.openwall.com
Subject: Re: vsftpd download backdoored
On Mon, Jul 4, 2011 at 9:04 PM, HD Moore <hdm@...italoffense.net> wrote:
> On 7/4/2011 10:58 PM, Solar Designer wrote:
>> What mirror? As far as I'm aware, from the announcement by Chris, only
>> the official distribution site for vsftpd was compromised.
> [ snip ]
>> Maybe. Do you have a copy of the backdoored tarball? I don't, and no
>> one on forums where I saw this discussed appears to have it (which
>> confirms that it existed for a very short period of time only).
>
> This copy is backdoored and has mtime Feb-15-2011. Chris didn't reply
> when I asked him for a copy from his master (old/vsftpd-2.3.4.tar.gz).
Yeah, on vacation at the moment but looks like you found a good alternative?
FWIW, https://docs.
Google.com/leaf?id=0B-_usSLlqH60Y2QwZDM0YWEtYWY0My00NmM5LWI3NDAtY2Y0MzRiOTg5ZGJm&hl=en_US
Seems strange to me that the attacker would remember to update mtime
on the replacement tarball, but leave .o files kicking around (thus
also changing tarball size radically).
Cheers
Chris
>
> http://download.polytechnic.edu.na/pub2/vsftpd/vsftpd-2.3.4.tar.gz
>
>> Are you trying to say that Debian got the backdoored copy? This is news
>> to me.
>
> No, I am saying that for this to become as widespread as the mtime in
> the mirror above indicates, it would be incredible for distros like
> Debian to not notice it, as they verify the hash of the tarball. This
> indicates that the mtime in the mirror above was forged (since the hash
> is indeed wrong), but the real question is how this mirror obtained the
> copy.
>
> Was the mirror compromised? Was a rsync job used against the real
> server, in which case the mtime was preserved? I couldn't find any
> public copies with the backdoored checksum, but one of the metasploit
> contributors pointed me to the link above.
>
> I would like to believe the exposure was limited to 1-3 days, but the
> mirror above casts doubt on this.
>
> -HD
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
