Home page logo

oss-sec logo oss-sec mailing list archives

Re: vsftpd download backdoored
From: Solar Designer <solar () openwall com>
Date: Tue, 5 Jul 2011 06:26:44 +0400

On Tue, Jul 05, 2011 at 10:09:32AM +0800, Eugene Teo wrote:
I did not verify.

(09:55:37 AM) hdmoore: The timestamp on vsftpd-2.3.4.tar.gz
http://bit.ly/j4VC5y indicates that the backdoor was present from Feb
15th -> July 3rd (via mc)

Looks unrealistic to me.  Feb 15 is when 2.3.4 was released by Chris.
A copy I downloaded has mtime Feb 15 (preserved from the official
download site) and ctime Mar 2 (when I downloaded it).  It passes the
GPG signature check and lacks the backdoor.

Additionally, searching for the SHA-256 digest that Chris posted reveals
only copies of his announcement of the incident and news stories about
it.  No hits for any distro's filelists, etc.  I wish we had MD5 and
SHA-1 to also search for, though.  I don't have a copy of the backdoored
vsftpd tarball to compute those, but we can ask Chris for them.

My gut feeling is that the backdoored tarball has been on the site for
1 to 3 days.  But I could be wrong.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]