Skip to Content.
Sympa Menu

sm-grimoire - Re: [SM-Grimoire]OpenSSH trojan....

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Dufflebunk <dufflebunk AT dufflebunk.homeip.net>
  • To: Andrew Stitt <afrayedknot AT thefrayedknot.armory.com>
  • Cc: "Sergey A. Lipnevich" <sergeyli AT pisem.net>, SourceMage Grimoire <sm-grimoire AT lists.ibiblio.org>
  • Subject: Re: [SM-Grimoire]OpenSSH trojan....
  • Date: 02 Aug 2002 03:35:42 -0400

You should not have to rebuild anything except perhaps the stuff you
have built since you cast the bad openSSH. cast --fix does MD5 checking
on all files and will detect tampering (except on config files!). At
least, this is my understanding of part of what --fix does... and I've
always thought it one of to cooler features, a light weight IDS built
in.

On Fri, 2002-08-02 at 00:44, Andrew Stitt wrote:
> so my logs are showing that my sorcery update updated ssl, and thus ssh
> on the morning of the 31st, however theres nothing about a bad md5sum
> anywhere, do i still need to rebuild my system from scratch?
>
> *sighs at the thought of doing anything after working for a full 12 hour
> day*
>
> On Fri, Aug 02, 2002 at 12:30:16AM -0400, Sergey A. Lipnevich wrote:
> > It was compromised on July 30-31, so if 'gaze installed | grep openssh'
> > tells you that you installed it before these dates, do nothing -- you
> > are safe. If it shows you 2002073{0|1}, do nothing still -- you're
> > compromised and the only true dao out of this is through complete wipe
> > out ;-). Unless you're the one who trojaned poor thing...
> > The spell has correct MD5 btw.
> >
> > Robin Cook wrote:
> >
> > >Do all we need to do is recast this once a clean version is posted or
> > >do we need to do something with the spell itself?
> > >
> > >CuZnDragon
> > >Robin Cook
> > >
> > >
> >
> > _______________________________________________
> > SM-Grimoire mailing list
> > SM-Grimoire AT lists.ibiblio.org
> > http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
> _______________________________________________
> SM-Grimoire mailing list
> SM-Grimoire AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>
--


Quidquid latine dictum sit, altum sonatur.
-----------------
PGP public key at
http://wwwkeys.ch.pgp.net:11371/pks/lookup?op=get&search=0x92B5D3F1

Attachment: signature.asc
Description: This is a digitally signed message part




Archive powered by MHonArc 2.6.24.

Top of Page