Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] [ALERT] CERT Advisory CA-2002-28 Trojan Horse Sendmail Distribution

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "M.L." <mlubrano AT sourcemage.org>
  • To: bluebird AT optushome.com.au, sm-grimoire AT lists.ibiblio.org, sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] [ALERT] CERT Advisory CA-2002-28 Trojan Horse Sendmail Distribution
  • Date: Wed, 9 Oct 2002 08:19:13 +0200

On Mercredi 9 Octobre 2002 08:06, M.L. wrote:
> On Mercredi 9 Octobre 2002 04:54, bluebird AT optushome.com.au wrote:
> > See the announcement for details.
> >
> > The following files were modified to include the malicious code:
> > sendmail.8.12.6.tar.Z
> > sendmail.8.12.6.tar.gz
> > These files began to appear in downloads from the FTP
> > server ftp.sendmail.org on or around September 28, 2002.
> >
> > http://www.cert.org/advisories/CA-2002-28.html
>
> Oh SHIT ! I've updated to 8.12.6 on 30th of Sep 02.
>
> The current MD5 in sendmail's spell is 83d778fbf2cdd345319283a95aa9563f
> (.tar file).
>
> I'm on it.
>

Ok, we're safe I guess...

The current spell's MD5 is correct, and matches the current clean official
sendmail MD5...

See below:
================================================
08:14:33 (16.49 MB/s) - `sendmail.8.12.6.tar.gz' saved [1867436/1867436]

ml@nostromo:/tmp$ md5sum sendmail.8.12.6.tar.gz
73e18ea78b2386b774963c8472cbd309 sendmail.8.12.6.tar.gz

=> matches 73e18ea78b2386b774963c8472cbd309 sendmail.8.12.6.tar.gz

ml@nostromo:/tmp$ gunzip sendmail.8.12.6.tar.gz
ml@nostromo:/tmp$ md5sum sendmail.8.12.6.tar
83d778fbf2cdd345319283a95aa9563f sendmail.8.12.6.tar

=> matches the current spell's MD5 83d778fbf2cdd345319283a95aa9563f
================================================


I strongly encourage sendmail users to:

dispel sendmail
rm /var/spool/sorcery/sendmail.8.12.6.tar.gz
rm /var/cache/sorcery/sendmail... (depends on your architecture)
cast sendmail

Bye,
Mat.


> > _______________________________________________
> > SM-Discuss mailing list
> > SM-Discuss AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-discuss

--
//
// M.L.
// Linux User #36502 ; ICQ #23832402
//




Archive powered by MHonArc 2.6.24.

Top of Page