sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

[SM-Discuss] Libpcap & tcpdump trojans

From: elaine forbes <elaine AT fwsystems.com>
To: lunar AT moongroup.com
Cc: <sm-discuss AT lists.ibiblio.org>
Subject: [SM-Discuss] Libpcap & tcpdump trojans
Date: Wed, 13 Nov 2002 10:14:09 -0500

While it looks as if this was caught quite quickly (by the Gentoo checksum
system btw) and it's unlikely that any systems have downloaded the hacked
sources.

The correct md5 checksums are:

0597c23e3496a5c108097b2a0f1bd0c7 libpcap-0.7.1.tar.gz
03e5eac68c65b7e6ce8da03b0b0b225e tcpdump-3.7.1.tar.gz

The Lunar cached sources are clean

the trojanned versions are reported as:

MD5 Sum 73ba7af963aff7c9e23fa1308a793dca libpcap-0.7.1.tar.gz
MD5 Sum 3c410d8434e63fb3931fe77328e4dd88 tcpdump-3.7.1.tar.gz

Out of purely academic interest I'd be glad to hear whether anyone has
a positive on the 'bad' versions

elaine

[SM-Discuss] Libpcap & tcpdump trojans, elaine forbes, 11/13/2002