nanog mailing list archives

RE: OT: CPAN hacked or fubar'd?

From: "Eric Germann" <ekgermann () cctec com>
Date: Sun, 28 Sep 2003 17:33:03 -0400


Hmmmmmmm.......

bash-2.05$ dig www.cpan.org

; <<>> DiG 8.3 <<>> www.cpan.org 
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 4
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 3
;; QUERY SECTION:
;;      www.cpan.org, type = A, class = IN

;; ANSWER SECTION:
www.cpan.org.           23h38m8s IN CNAME  x2.develooper.com.
x2.develooper.com.      1h38m8s IN A    213.150.60.27

;; AUTHORITY SECTION:
develooper.com.         2d23h38m8s IN NS  ns2.develooper.com.
develooper.com.         2d23h38m8s IN NS  ns3.develooper.com.
develooper.com.         2d23h38m8s IN NS  ns.develooper.com.

;; ADDITIONAL SECTION:
ns.develooper.com.      1d23h34m37s IN A  63.251.223.170
ns2.develooper.com.     1h38m8s IN A    213.150.60.27
ns3.develooper.com.     1h38m8s IN A    213.150.60.27

;; Total query time: 37 msec
;; FROM: petros.cctec.net to SERVER: default -- 172.28.0.20
;; WHEN: Sun Sep 28 17:26:56 2003
;; MSG SIZE  sent: 30  rcvd: 178



bash-2.05$ telnet www.cpan.org 80
Trying 213.150.60.27...
Connected to x2.develooper.com.
Escape character is '^]'.
GET / HTTP/1.0

HTTP/1.1 302 Found
Date: Sun, 28 Sep 2003 21:28:12 GMT
Server: Apache/1.3.29-dev (Unix) PHP/4.3.3 mod_perl/1.28_01-dev
Location: http://www.netcetera.dk
Content-Type: text/html; charset=iso-8859-1
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>302 Found</TITLE>
</HEAD><BODY>
<H1>Found</H1>
The document has moved <A HREF="http://www.netcetera.dk";>here</A>.<P>
<HR>
<ADDRESS>Apache/1.3.29-dev Server at virtualhost.netc.dk Port 80</ADDRESS>
</BODY></HTML>
Connection closed by foreign host.

Same with a host header using HTTP/1.1 ...

-----Original Message-----
From: Rachael Treu [mailto:rara () navigo com]
Sent: Sunday, September 28, 2003 5:33 PM
To: Eric Germann
Cc: nanog () nanog org
Subject: Re: OT: CPAN hacked or fubar'd?

I'm not able to duplicate what you report.  All indications from
the vectors I've tried are that CPAN is alive and well.

Got more info?

--ra

On Sun, Sep 28, 2003 at 05:10:58PM -0400, Eric Germann said 
something to the effect of:


Anyone know whats up with CPAN? http://www.cpan.org points to
http://www.netcetera.dk

Pointers would be appreciated and also if we can trust the CPAN

module to

install modules.

==========================================================================

  Eric Germann                                        CCTec
  ekgermann () cctec com                                 Van Wert OH 45891
  http://www.cctec.com                                Ph:  419 968 2640
                                                      Fax: 603 825 5893

"The fact that there are actually ways of knowing and characterizing the
extent of one’s ignorance, while still remaining ignorant, may

ultimately be

more interesting and useful to people than Yarkovsky"

  -- Jon Giorgini of NASA’s Jet Propulsion Laboratory


-- 
K. Rachael Treu, CISSP     rara () navigo com
.Fata viam invenient..

Current thread:

OT: CPAN hacked or fubar'd? Eric Germann (Sep 28)
- Re: OT: CPAN hacked or fubar'd? Rachael Treu (Sep 28)
  - RE: OT: CPAN hacked or fubar'd? Eric Germann (Sep 28)