From owner-freebsd-ports@FreeBSD.ORG Sat Nov 10 14:55:01 2007 Return-Path: Delivered-To: freebsd-ports@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EBE5C16A418 for ; Sat, 10 Nov 2007 14:55:01 +0000 (UTC) (envelope-from mike.freebsd@gmail.com) Received: from rv-out-0910.google.com (rv-out-0910.google.com [209.85.198.185]) by mx1.freebsd.org (Postfix) with ESMTP id BD96213C4B9 for ; Sat, 10 Nov 2007 14:55:01 +0000 (UTC) (envelope-from mike.freebsd@gmail.com) Received: by rv-out-0910.google.com with SMTP id l15so678438rvb for ; Sat, 10 Nov 2007 06:54:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; bh=/NZGh3C61w3HNPTUqJZutkt4+8o6zYcGgXLYFkF2CIA=; b=G/5WNl/kjzhqawn5QmUaoMGbCZRfsSFwYTDLTg2Xc0j8DfJ7W4XIVfeyB8TGX7QRk5MFU4enXG7d/djopA8hAHyBtouvbPP2GVpils/olaFK4k8UVrg7wReWOrSXnlHvockyzRSkPK/KRboNUe5gz7sCl3YiCmi/WRt7aGuYI8w= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; b=ILTz1/0M2toMe/Upe3vgZht666b/IGshcuGYzcKRvYU1Bi4aI6HM6yNxX/r6ObV9l7XIR5K0x5Rwd5a+3MybDj1CRFgERIdhjf0QSZarLCz9clfg+5DzP/Cz88NTd6mcUA/N1e2hzxR3OTjl2uxOcSghRDQL3JtjCotSXMaJpb0= Received: by 10.141.88.3 with SMTP id q3mr1535082rvl.1194704757980; Sat, 10 Nov 2007 06:25:57 -0800 (PST) Received: by 10.141.141.4 with HTTP; Sat, 10 Nov 2007 06:25:57 -0800 (PST) Message-ID: <84f7f5800711100625l6a0ef442m1a6824fa74c56972@mail.gmail.com> Date: Sat, 10 Nov 2007 15:25:57 +0100 From: "Mike -freebsd" To: freebsd-ports@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline Subject: 4203:31337 (possible exploit?) X-BeenThere: freebsd-ports@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Porting software to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Nov 2007 14:55:02 -0000 Guys, is anyone else seeing this? Check for files with an unknown user or group: /usr/ports /usr/ports/Mk /usr/ports/Mk/bsd.commands.mk /usr/ports/Mk/bsd.apache.mk [.....whole ports tree.....] # ls -al /usr/ total 48 drwxr-xr-x 14 root wheel 512 Jun 27 20:01 . drwxr-xr-x 23 root wheel 512 Nov 4 20:51 .. lrwxr-xr-x 1 root wheel 10 Oct 14 14:45 X11R6 -> /usr/local drwxr-xr-x 2 root wheel 7168 Nov 7 05:04 bin drwxr-xr-x 2 root wheel 512 Oct 20 06:38 games drwxr-xr-x 47 root wheel 4608 Oct 20 06:39 include drwxr-xr-x 6 root wheel 8192 Oct 20 06:39 lib drwxr-xr-x 5 root wheel 512 Jan 27 2007 libdata drwxr-xr-x 5 root wheel 1536 Oct 20 06:39 libexec drwxr-xr-x 14 root wheel 512 Oct 17 16:55 local drwxr-xr-x 3 root wheel 512 Oct 20 14:13 obj drwxr-xr-x 69 4203 31337 1536 Nov 9 13:59 ports drwxr-xr-x 2 root wheel 4608 Oct 20 06:39 sbin drwxr-xr-x 26 root wheel 512 Jan 27 2007 share drwxr-xr-x 23 root wheel 1024 Oct 20 04:55 src I see this on three of four FreeBSD 7 boxes and only on /usr/ports/ (why...?). Anyone else?