SECURITY: is sendmail bugged?!?!?!

Rroet

Did gentoo use the wrong sendmail package??
All sendmail packages downloaded from the sendmail FTP site between 28th of september and 6th of October contain a trojan horse.

This is the CERT anouncement: http://www.cert.org/advisories/CA-2002-28.html

Just so you know!! I hope Gentoo comes with an update soon...

Curious · Posted: Wed Oct 09, 2002 5:38 am Post subject:

Sigh.

If you consult the ebuild for sendmail, you'll find that the MD5 sum that portage verifies the downloaded Sendmail against is the same as CERT gave out for the 'clean' build.

Trojaned packages would have failed MD5, and I *think* Portage would then have attempted to use another mirror. In fact, I think it would have been attempting to use a mirror in the first place ( ibiblio, for example ).

There is no need for an update.

-- Curious
_________________
Are you down with the Hawk?

Rroet · Posted: Wed Oct 09, 2002 5:44 am Post subject:

I hope so.. thnx.. will look at the ebuild file next time. for the MD5 hash.. good one.. didn't know it checked the sourcefile with a md5 hash.

Curious · Posted: Wed Oct 09, 2002 6:58 am Post subject:

pilla · Posted: Wed Oct 09, 2002 1:37 pm Post subject:

apt (used by Debian and Conectiva) have signed packages. As long as you have the keys from the ditribution, you can check all packages and be sure they are OK.