Re: vsftpd download backdoored

[Solar Designer <solar () openwall com>]

On Mon, Jul 04, 2011 at 11:04:00PM -0500, HD Moore wrote:
> This copy is backdoored and has mtime Feb-15-2011. Chris didn't reply
> when I asked him for a copy from his master (old/vsftpd-2.3.4.tar.gz).
>
> http://download.polytechnic.edu.na/pub2/vsftpd/vsftpd-2.3.4.tar.gz

So, I tried searching for MD5, SHA-1, and SHA-512 of this - no hits on
Google web search.  Lots of hits for SHA-256, indeed - due to the
incident announcement.

Thus, chances are that no distro is affected.

More info on what's inside the tarball: user/group "user" (either the
intruder's username on his/her computer or --owner and --group options
argument to tar), "GCC: (Ubuntu/Linaro 4.5.2-8ubuntu4) 4.5.2" inside the
.o files.  This suggests Ubuntu 11.04, right?

BTW, what if the .o files _don't_ match the source code? ;-)  I think
they might be used when one builds vsftpd from this tarball, which means
that the build (or run) will fail on some older systems (yet another
reason why this would be noticed quickly), but also that the actual
backdoor might be different (and more sophisticated) from what we see in
the source code.  No, I don't think this is the case, but the
possibility is there, and I find it curious.

A trivial way to check for this would be to try compiling the source
code on Ubuntu 11.04 and see if the .o files match.  If not, the
differences will need to be analyzed manually.  Not that anyone cares...

Alexander