Re: [Full-disclosure] e107 latest download link is backdoored

[Christian Sciberras <uuf6429@xxxxxxxxx>]

If that is so, being silent on the matter is not good at all...






On Tue, Jan 26, 2010 at 9:28 AM, Bogdan Calin <bogdan@xxxxxxxxxxxx> wrote:

> Here is my speculation on what happened:
>
> A few days ago, somebody found and exploited a e107 0day (for 0.7.16) on
> some websites. The e107 guys were informed about this and released
> 0.7.17 to fix this problem.
>
> However, at this point I suspect they were already hacked because they
> are running e107 on e107.org and they were an obvious target.
>
> The attackers waited until they released the security fix (0.7.17) and
> modified the zip file to include the backdoor.
>
> At this point, most e107 site owners were rushing to upgrade because of
> security update announcement and I suspect that many people have
> downloaded the backdored binary.
>
> However, this is just a speculation. I have no actual data behind it.
>
> Christian Sciberras wrote:
> > Don't know the date at your place, but it's 25th Jan here, not 22nd. ;)
> >
> >
> >
> >
> >
> >
> > On Mon, Jan 25, 2010 at 10:36 PM, Michael Holstein <
> > michael.holstein@xxxxxxxxxxx> wrote:
> >
> >>> Speaking of silent fixes...
> >> Silent? .. it's right on the "news" section of the e107.org front page.
> >> To wit :
> >>
> >> [http://e107.org]
> >>
> >>
> >>        **SECURITY UPDATE** 0.7.17
> >>
> >> We were recently informed of a very nasty exploit that, as far as we can
> >> see, affects almost all e107 0.7 releases. Everyone running e107 needs
> >> to get their sites updated as soon as possible. If you are a site owner
> >> and you are unable to upgrade for some reason (too much hacked core
> >> code), please contact me directly and I can help you with a quick-fix.
> >>
> >> Please get the word out to all other e107ers. If you find an e107 site
> >> out there, post on their site somewhere about this upgrade.
> >>
> >>
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> --
> Bogdan Calin - bogdan@xxxxxxxxxxxx
> CTO
> Acunetix Ltd. - http://www.acunetix.com
> Acunetix Web Security Blog - http://www.acunetix.com/blog
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/