Re: vsftpd download backdoored

[Eugene Teo <eugene () redhat com>]

On 07/05/2011 01:25 AM, Solar Designer wrote:
> On Mon, Jul 04, 2011 at 06:56:57PM +0200, Moritz Muehlenhoff wrote:
> > IIRC for such backdoored downloads CVE IDs were assigned in the past
> > to properly track the status of distributions providing the affected 
> > piece of code.
>
> I suspect that no distributions provide the affected code this time.
> So if affected distributions is the only reason for CVE ID assignment in
> this case, it might make sense to postpone CVE ID allocation until we
> learn of an affected distribution (which we probably won't).

I did not verify.

(09:55:37 AM) hdmoore: The timestamp on vsftpd-2.3.4.tar.gz
http://bit.ly/j4VC5y indicates that the backdoor was present from Feb
15th -> July 3rd (via mc)

Eugene