bugtraq - Re: Sourceforge compromized?

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Fri, 2 Feb 2007 11:57:45 -0500 (EST)
From: "Serguei A. Mokhov" <mokhov@...concordia.ca>
To: Michael Scheidell <scheidell@...nap.net>
Subject: Re: Sourceforge compromized?

On Fri, 2 Feb 2007, Michael Scheidell wrote:

> Date: Fri, 2 Feb 2007 06:40:21 -0500
>
> http://yapig.sourceforge.net/demo/photos/photos2291.html
>
> (no one under 18 should click on that link above, it may violate state
> laws doing so)
>
> Could someone from sourceforge.net comment? What else is compromised on
> the server?
>
> Can just anyone post anything to any directory or are there specific
> directories that can be hacked?
>
> Is it just yapig.sourceforge.net?

Yes, 'yapig' is one of the many thousands projects on the sf.net. Every
project gets a soft quota of 100Mb web space to put whatever they "want".
("Want" in a sense the project memebers may have shell access and can
upload arbitrary contents, presumably should be legal contents..., but
they users get to control what to put under their project space.)

> Either case, I should suggest everyone be careful about what you
> download from sourceforge till they do a full code audit and post the
> results here.

If you find offensive or illegal content on sf.net (I did not check the
link you provided), I suggest you report it to SourceForge here:

  http://sourceforge.net/tracker/?func=add&group_id=1&atid=200001

-- 
Serguei A. Mokhov            |  /~\    The ASCII
Computer Science Department  |  \ / Ribbon Campaign
Concordia University         |   X    Against HTML
Montreal, Quebec, Canada     |  / \      Email!