Date: Thu, 1 Aug 2002 23:11:53 -0400 From: Rob Andrews <rob@cyberpunkz.org> To: freebsd-security@FreeBSD.ORG Subject: Re: CERT Advisory CA-2002-24 Trojan Horse OpenSSH Distribution (fwd) Message-ID: <20020802031153.GB74929@switchblade.cyberpunkz.org> In-Reply-To: <xzpsn1y9ior.fsf@flood.ping.uio.no> References: <Pine.BSI.4.05L.10208011754400.28569-100000@rs.netgate.net> <xzpsn1y9ior.fsf@flood.ping.uio.no>
next in thread | previous in thread | raw e-mail | index | archive | help
--zYM0uCDKw75PZbzx Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable =2E- - - - - - Dag-Erling Smorgrav wrote (2002/08/01 at 09:02:48 PM) - - - = - - - | |> Chris Miller <ctodd@netgate.net> writes: |> > Are we affected by this? I couldn't find bf-test.c in the openssh |> > directory in /usr/ports. I'm assuming that since the part of the autom= agic |> > process of building the port involves checking the checksum that we are |> > safe, but I thought it best to ask. |>=20 |> We're safe. |>=20 Technically, yes provided system maintainers did not install openssh during the time period the trojaned tarballs were available and didn't decide to force the software to install on the system when the md5 checksum failed to match. During the period openssh was trojaned I was doing system upgrades and rebuilding openssh as well with updated libraries. As a rule I never force software to install if the md5 checksum fails.. Some people ignore this and install anyway. -- Rob Andrews RELI Networks, Inc. --zYM0uCDKw75PZbzx Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (FreeBSD) iD8DBQE9Sfh5AXwJ9YLqJJURAlxzAJ42O1XrGfXZpoFH3BCfJ3jbWostxgCfS4oG u2GukH1r6AQpOgFyk9M7fQU= =0wQ9 -----END PGP SIGNATURE----- --zYM0uCDKw75PZbzx-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020802031153.GB74929>