Re: e107 latest download link is backdoored

[Christian Sciberras <uuf6429 () gmail com>]

If that is so, being silent on the matter is not good at all...






On Tue, Jan 26, 2010 at 9:28 AM, Bogdan Calin <bogdan () acunetix com> wrote:

> Here is my speculation on what happened:
>
> A few days ago, somebody found and exploited a e107 0day (for 0.7.16) on
> some websites. The e107 guys were informed about this and released
> 0.7.17 to fix this problem.
>
> However, at this point I suspect they were already hacked because they
> are running e107 on e107.org and they were an obvious target.
>
> The attackers waited until they released the security fix (0.7.17) and
> modified the zip file to include the backdoor.
>
> At this point, most e107 site owners were rushing to upgrade because of
> security update announcement and I suspect that many people have
> downloaded the backdored binary.
>
> However, this is just a speculation. I have no actual data behind it.
>
> Christian Sciberras wrote:
> > Don't know the date at your place, but it's 25th Jan here, not 22nd. ;)
> >
> >
> >
> >
> >
> >
> > On Mon, Jan 25, 2010 at 10:36 PM, Michael Holstein <
> > michael.holstein () csuohio edu> wrote:
> >
> > > > Speaking of silent fixes...
> > > Silent? .. it's right on the "news" section of the e107.org front page.
> > > To wit :
> > >
> > > [http://e107.org]
> > >
> > >
> > >        **SECURITY UPDATE** 0.7.17
> > >
> > > We were recently informed of a very nasty exploit that, as far as we can
> > > see, affects almost all e107 0.7 releases. Everyone running e107 needs
> > > to get their sites updated as soon as possible. If you are a site owner
> > > and you are unable to upgrade for some reason (too much hacked core
> > > code), please contact me directly and I can help you with a quick-fix.
> > >
> > > Please get the word out to all other e107ers. If you find an e107 site
> > > out there, post on their site somewhere about this upgrade.
> >
> >
> > ------------------------------------------------------------------------
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
>
> --
> Bogdan Calin - bogdan () acunetix com
> CTO
> Acunetix Ltd. - http://www.acunetix.com
> Acunetix Web Security Blog - http://www.acunetix.com/blog
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/