Re: vsftpd download backdoored

[HD Moore <hdm () digitaloffense net>]

On 7/4/2011 10:58 PM, Solar Designer wrote:
> What mirror?  As far as I'm aware, from the announcement by Chris, only
> the official distribution site for vsftpd was compromised.
[ snip ]
> Maybe.  Do you have a copy of the backdoored tarball?  I don't, and no
> one on forums where I saw this discussed appears to have it (which
> confirms that it existed for a very short period of time only).

This copy is backdoored and has mtime Feb-15-2011. Chris didn't reply
when I asked him for a copy from his master (old/vsftpd-2.3.4.tar.gz).

http://download.polytechnic.edu.na/pub2/vsftpd/vsftpd-2.3.4.tar.gz

> Are you trying to say that Debian got the backdoored copy?  This is news
> to me.

No, I am saying that for this to become as widespread as the mtime in
the mirror above indicates, it would be incredible for distros like
Debian to not notice it, as they verify the hash of the tarball. This
indicates that the mtime in the mirror above was forged (since the hash
is indeed wrong), but the real question is how this mirror obtained the
copy.

Was the mirror compromised? Was a rsync job used against the real
server, in which case the mtime was preserved? I couldn't find any
public copies with the backdoored checksum, but one of the metasploit
contributors pointed me to the link above.

I would like to believe the exposure was limited to 1-3 days, but the
mirror above casts doubt on this.

-HD