Re: OpenSSH Security Advisory: Trojaned Distribution Files

[Dayton <smartestguy@technologist.com>]

Yeah, but another thing we all should be wondering is, were any OTHER
files tampered with? How safe is it, for example, for us to pull down
the patch branch right now?

On Thu, 1 Aug 2002, Martin Reindl wrote:

> > How did this happened? Solaris knockdown?
>
> Think so ...
> The server bf-test.c is refering to (203.62.158.32:6667) was running
> FreeBSD Apache 1.3.24 with the well known bug from April 11th till
> August 1st (according to netcraft.com).
> Maybe somebody knows how the trojan got on ftp.openbsd.org.
> The idiots out there already start blaming OpenSSH and OpenBSD for this.
> Btw, Response time restoring the original files seems really fast, i
> couldn't find any modified openssh-3.4p1.tar.gz today.
>
> Martin