[gentoo-dev] possible trojan in openssh-3.4p1

[Rob Kaper]

Pat, Neil, Gentoo devs, KDE friends:

>From #kde-freebsd:

<knu> ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.4p1.tar.gz is trojaned
<tap> nothing on google either
<knu> steals /etc/passwd to send to a certain IRC network and removes itself
<Capzilla> knu : says who
<knu> see the code, but never run make
<knu> openbsd-compat/{Makefile.in,bf-test.c}

Looks like some weird stuff is in there indeed.

md5sum of the binary that appears to be trojaned:

3ac9bc346d736b4a51d676faa2a08a57  openssh-3.4p1.tar.gz

As far as I can see, compiled binaries are *not* affected, but you might
want to carefully examin this more closely (I'm waiting with upgradepkg en
emerge on my systems until there's some more info). We've had a few hoaxes
recently, but this looks suspicious.

My apologies if this is just a storm in a glass of water.

Rob
-- 
Rob Kaper     | Gimme some love, gimme some skin,
cap@×××××.com | if we ain't got that then we ain't got much
www.capsi.com | and we ain't got nothing, nothing! -- "Nothing" by A