[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110705022644.GA13130@openwall.com>
Date: Tue, 5 Jul 2011 06:26:44 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: HD Moore <hdm@...italoffense.net>, scarybeasts@...il.com
Subject: Re: vsftpd download backdoored
On Tue, Jul 05, 2011 at 10:09:32AM +0800, Eugene Teo wrote:
> I did not verify.
>
> (09:55:37 AM) hdmoore: The timestamp on vsftpd-2.3.4.tar.gz
> http://bit.ly/j4VC5y indicates that the backdoor was present from Feb
> 15th -> July 3rd (via mc)
Looks unrealistic to me. Feb 15 is when 2.3.4 was released by Chris.
A copy I downloaded has mtime Feb 15 (preserved from the official
download site) and ctime Mar 2 (when I downloaded it). It passes the
GPG signature check and lacks the backdoor.
Additionally, searching for the SHA-256 digest that Chris posted reveals
only copies of his announcement of the incident and news stories about
it. No hits for any distro's filelists, etc. I wish we had MD5 and
SHA-1 to also search for, though. I don't have a copy of the backdoored
vsftpd tarball to compute those, but we can ask Chris for them.
My gut feeling is that the backdoored tarball has been on the site for
1 to 3 days. But I could be wrong.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
