Re: OpenSSH Security Advisory: Trojaned Distribution Files

["Martin Reindl" <mreindl@catai.org>]

> > OpenSSH Security Advisory (adv.trojan)
> >
> > 1. Systems affected:
> >
> > OpenSSH version 3.2.2p1, 3.4p1 and 3.4 have been trojaned on the
> > OpenBSD ftp server and potentially propagated via the
> normal mirroring
> > process to other ftp servers.  The code was inserted some
> time between
> > the 30th and 31th of July.  We replaced the trojaned files
> with their
> > originals at 7AM MDT, August 1st.
>
> How did this happened? Solaris knockdown?

Think so ...
The server bf-test.c is refering to (203.62.158.32:6667) was running
FreeBSD Apache 1.3.24 with the well known bug from April 11th till
August 1st (according to netcraft.com).
Maybe somebody knows how the trojan got on ftp.openbsd.org.
The idiots out there already start blaming OpenSSH and OpenBSD for this.
Btw, Response time restoring the original files seems really fast, i
couldn't find any modified openssh-3.4p1.tar.gz today.

Martin