full-disclosure - Re: e107 latest download link is backdoored

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 25 Jan 2010 16:36:50 -0500
From: Michael Holstein <michael.holstein@...ohio.edu>
To: Christian Sciberras <uuf6429@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: e107 latest download link is backdoored

> Speaking of silent fixes...

Silent? .. it's right on the "news" section of the e107.org front page.
To wit :

[http://e107.org]

        **SECURITY UPDATE** 0.7.17

We were recently informed of a very nasty exploit that, as far as we can
see, affects almost all e107 0.7 releases. Everyone running e107 needs
to get their sites updated as soon as possible. If you are a site owner
and you are unable to upgrade for some reason (too much hacked core
code), please contact me directly and I can help you with a quick-fix.

Please get the word out to all other e107ers. If you find an e107 site
out there, post on their site somewhere about this upgrade.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/