1 |
----- Forwarded message from Daniel Robbins <drobbins@g.o> ----- |
2 |
|
3 |
To: gentoo-announce@g.o, bugtraq@×××××××××××××.com |
4 |
From: Daniel Robbins <drobbins@g.o> |
5 |
Date: Wed, 03 Dec 2003 10:53:37 -0700 |
6 |
Subject: [gentoo-announce] GLSA: rsync.gentoo.org rotation server compromised (200312-01) |
7 |
X-Mailer: Ximian Evolution 1.4.5 |
8 |
Organization: Gentoo Technologies, Inc. |
9 |
|
10 |
- --------------------------------------------------------------------------- |
11 |
GENTOO LINUX SECURITY ANNOUNCEMENT 200312-01 |
12 |
- --------------------------------------------------------------------------- |
13 |
|
14 |
GLSA: 200312-01 |
15 |
summary: rsync.gentoo.org rotation server compromised |
16 |
severity: normal |
17 |
date: 2003-12-02 |
18 |
CVE: None |
19 |
exploit: remote |
20 |
|
21 |
DESCRIPTION: |
22 |
|
23 |
On December 2nd at approximately 03:45 UTC, one of the servers that makes up |
24 |
the rsync.gentoo.org rotation was compromised via a remote exploit. At this |
25 |
point, we are still performing forensic analysis. However, the compromised |
26 |
system had both an IDS and a file integrity checker installed and we have a |
27 |
very detailed forensic trail of what happened once the box was breached, so |
28 |
weare reasonably confident that the portage tree stored on that box |
29 |
wasunaffected. |
30 |
|
31 |
The attacker appears to have installed a rootkit and modified/deleted some |
32 |
files to cover their tracks, but left the server otherwise untouched. The box |
33 |
was in a compromised state for approximately one hour before it was |
34 |
discovered and shut down. During this time, approximately 20 users |
35 |
synchronized against the portage mirror stored on this box. The method used |
36 |
to gain access to the box remotely is still under investigation. We will |
37 |
release more details once we have ascertained the cause of the remote |
38 |
exploit. |
39 |
|
40 |
This box is not an official Gentoo infrastructure box and is instead donated |
41 |
by a sponsor. The box provides other services as well and the sponsor has |
42 |
requested that we not publicly identify the box at this time. Because the |
43 |
Gentoo part of this box appears to be unaffected by this exploit, we are |
44 |
currently honoring the sponsor's request. That said, if at any point, we |
45 |
determine that any file in the portage tree was modified in any way, we will |
46 |
release full details about the compromised server. |
47 |
|
48 |
SOLUTION: |
49 |
|
50 |
Again, based on the forensic analysis done so far, we are reasonably |
51 |
confident that no files within the Portage tree on the box were affected. |
52 |
However, the server has been removed from all rsync.*.gentoo.org rotations |
53 |
and will remain so until the forensic analysis has been completed and the box |
54 |
has been wiped and rebuilt. Thus, users preferring an extra level of security |
55 |
may ensure that they have a correct and accurate portage tree by running: |
56 |
|
57 |
emerge sync |
58 |
|
59 |
Which will perform a sync against another server and ensure that all files |
60 |
are up to date. |
61 |
|
62 |
----- End forwarded message ----- |
63 |
|
64 |
|
65 |
jakas plaga najpierw debian teraz gentoo. |
66 |
Pewno M$ wynajal jakas grupe wandali zeby pograzyla linuksa |
67 |
|
68 |
p.s |
69 |
Pozwolilem sobie to wyslac bo jakos smutno tu ;-) |
70 |
|
71 |
|
72 |
-- |
73 |
------------------------------------------------------------------------ |
74 |
Free your mind, and your OS will follow |
75 |
--| gentoolinux.prv.pl |----------------------| www.FreeBSD.friko.pl |-- |
76 |
|
77 |
-- |
78 |
gentoo-user-pl@g.o mailing list |