bugtraq - Re: heanet.dl.sourceforge.net hacked?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 30 Apr 2008 18:23:14 +0200
From: Rainer Duffner <rainer@...ra-secure.de>
To: Michael Scheidell <scheidell@...nap.net>
Cc: bugtraq@...urityfocus.com
Subject: Re: heanet.dl.sourceforge.net hacked?

Michael Scheidell schrieb:
>
> or have wrong file?
>
> in attempting to upgrade png (due to security problem), we tried to 
> pull from sourceforge mirrors.
> (note below, libpng says file size for libpng-1.2.27.tar.bz2 with 
> scripts should be 641193)  heanet has a bigger file.
> other sourceforge.net mirrors have it right.
>
> Was heanet.dl hacked?  are some people downloading a trojanized 
> version of png?
> all attempts (in the past) to contact sourceforge had been useless.
>
> http://www.libpng.org/pub/png/libpng.html
>
>
> Attempting to fetch from 
> http://heanet.dl.sourceforge.net/sourceforge/libpng/.
> fetch: 
> http://heanet.dl.sourceforge.net/sourceforge/libpng/libpng-1.2.27.tar.bz2: 
> size mismatch: expected 641193, actual 804821
>


I now get identical files (well, at least from switch.ch and heanet and 
surfnet.




cheers,
Rainer