Re: [gentoo-dev] possible trojan in openssh-3.4p1

[Eric Noack <eric.noack@gmx.de>]

Am 01 Aug 2002 12:18:53 +0300
schrieb Vitaly Kushneriuk <vitaly_kushneriuk@yahoo.com>:

> It's indeed looks like a trojan. It doesn't send you'r etc/passwd tho.
> It connects to the 203.62.158.32[web.snsonline.net.] port 6667[irc]
> and opens shell session on that connection, so that whoever is in
> control there will be able to execute arbitraty commands on your system
> with you'r current privileges. especialy dangerouus if you compile as
> root.

im not so big into the code, but the file @ ibiblio.org seems to be ok

ftp://ibiblio.org/pub/Linux/distributions/gentoo/distfiles/openssh-3.4p1.tar.gz

-rw-r--r--    1 raven    users      837668 08-01 12:06
openssh-3.4p1.tar.gz.ibiblio.org
-rw-r--r--    1 raven    users      840574 08-01 11:46 openssh-3.4p1.tar.gz.dangerous_from.ftp.openbsd.org
-rw-r--r--    1 root     root       837668 08-01 11:35
openssh-3.4p1.tar.gz.ok

see the different sizes? interesting. that says enough.

however the file mentionen (openbsd-compat/bf-test.c) doesnt exist in the ibiblio version
so i hope this one is clean.


such thing must never happen!


Corvus Corax