full-disclosure - Re: e107 latest download link is backdoored

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3af3d47c1001260031i59a239c3la00c5dc9a006e311@mail.gmail.com>
Date: Tue, 26 Jan 2010 09:31:18 +0100
From: Christian Sciberras <uuf6429@...il.com>
To: Bogdan Calin <bogdan@...netix.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: e107 latest download link is backdoored

If that is so, being silent on the matter is not good at all...






On Tue, Jan 26, 2010 at 9:28 AM, Bogdan Calin <bogdan@...netix.com> wrote:

> Here is my speculation on what happened:
>
> A few days ago, somebody found and exploited a e107 0day (for 0.7.16) on
> some websites. The e107 guys were informed about this and released
> 0.7.17 to fix this problem.
>
> However, at this point I suspect they were already hacked because they
> are running e107 on e107.org and they were an obvious target.
>
> The attackers waited until they released the security fix (0.7.17) and
> modified the zip file to include the backdoor.
>
> At this point, most e107 site owners were rushing to upgrade because of
> security update announcement and I suspect that many people have
> downloaded the backdored binary.
>
> However, this is just a speculation. I have no actual data behind it.
>
> Christian Sciberras wrote:
> > Don't know the date at your place, but it's 25th Jan here, not 22nd. ;)
> >
> >
> >
> >
> >
> >
> > On Mon, Jan 25, 2010 at 10:36 PM, Michael Holstein <
> > michael.holstein@...ohio.edu> wrote:
> >
> >>> Speaking of silent fixes...
> >> Silent? .. it's right on the "news" section of the e107.org front page.
> >> To wit :
> >>
> >> [http://e107.org]
> >>
> >>
> >>        **SECURITY UPDATE** 0.7.17
> >>
> >> We were recently informed of a very nasty exploit that, as far as we can
> >> see, affects almost all e107 0.7 releases. Everyone running e107 needs
> >> to get their sites updated as soon as possible. If you are a site owner
> >> and you are unable to upgrade for some reason (too much hacked core
> >> code), please contact me directly and I can help you with a quick-fix.
> >>
> >> Please get the word out to all other e107ers. If you find an e107 site
> >> out there, post on their site somewhere about this upgrade.
> >>
> >>
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> --
> Bogdan Calin - bogdan@...netix.com
> CTO
> Acunetix Ltd. - http://www.acunetix.com
> Acunetix Web Security Blog - http://www.acunetix.com/blog
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/