Home page logo

oss-sec logo oss-sec mailing list archives

Re: vsftpd download backdoored
From: Matthias Andree <matthias.andree () gmx de>
Date: Tue, 05 Jul 2011 12:29:35 +0200

Am 05.07.2011 06:39, schrieb Solar Designer:

More info on what's inside the tarball: user/group "user" (either the
intruder's username on his/her computer or --owner and --group options
argument to tar), "GCC: (Ubuntu/Linaro 4.5.2-8ubuntu4) 4.5.2" inside the
.o files.  This suggests Ubuntu 11.04, right?

That's the tagline of "gcc --version" on my Ubuntu 11.04 system.

BTW, what if the .o files _don't_ match the source code? ;-)  I think
they might be used when one builds vsftpd from this tarball, which means
that the build (or run) will fail on some older systems (yet another
reason why this would be noticed quickly), but also that the actual
backdoor might be different (and more sophisticated) from what we see in
the source code.  No, I don't think this is the case, but the
possibility is there, and I find it curious.

A trivial way to check for this would be to try compiling the source
code on Ubuntu 11.04 and see if the .o files match.  If not, the
differences will need to be analyzed manually.  Not that anyone cares...

And you'd need to know the compiler options, flipping one optimization
manually is sufficient to make the .o files mismatch.

However the backdoored tarball apparently got removed from the listed
server (404 error), but I'm not interested in hunting one down.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]