Date: Fri, 29 Dec 2006 22:39:08 +0200 From: gareth <bsd@lordcow.org> To: stable@freebsd.org Subject: Re: system breach Message-ID: <20061229203908.GA6029@lordcow.org> In-Reply-To: <45956307.4090403@saeab.se> References: <20061228231226.GA16587@lordcow.org> <b91012310612282010m22a6bbdbp97bf7bdecca1530@mail.gmail.com> <20061229155845.GA1266@lordcow.org> <45954196.9040909@saeab.se> <20061229173916.GA3196@lordcow.org> <45956307.4090403@saeab.se>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri 2006-12-29 (19:48), Thomas Nystr?m wrote: > It looks like this: > > ture(root)# dir > total 50 > drwxrwxr-x 5 root wheel 512 29 Aug 16:29 ./ > drwxrwxrwt 11 root wheel 3072 29 Dec 19:35 ../ > drwxrwxr-x 4 root wheel 512 29 Aug 16:29 Archive_Tar-1.3.1/ > drwxrwxr-x 3 root wheel 512 29 Aug 16:29 Console_Getopt-1.2/ > drwxrwxr-x 3 root wheel 512 29 Aug 16:29 XML_RPC-1.5.0/ > -rw-rw-r-- 1 root wheel 15433 12 Jul 02:09 package.xml > -rw-rw-r-- 1 root wheel 22193 12 Jul 02:09 package2.xml snap ;) package*.xml are also "12 Jul 02:09" > Exactly which port that did this is hard to tell. I have around > 130 ports installed and most of them were updated 29:th Aug. > I have looked at the files that exists in these directories > and according to the +CONTENTS files in /var/db/pkg all is claimed > to belong to pear-1.4.11 so that might be a candidate..... ah yes, well played, md5's match too.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061229203908.GA6029>