Re: Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-14 Thread Steve Suehring
You are correct insofar as it triggers at compile time for libpcap, the configure script to be exact. I grabbed a copy of the trojan'ed libpcap and compiled it in a sandbox machine. You can do a strings of the compiled libpcap.a and grep for 1963. Doing so yields these results:

Re: Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-14 Thread Bart-Jan Vrielink
On Wed, 2002-11-13 at 20:15, Lupe Christoph wrote: Please read http://www.hlug.org/modules.php?op=modloadname=Newsfile=articlesid=6mode=threadorder=0thold=0 Is Debian affected? If I read this (and the CERT advisory) correctly, the trojan only triggers at compile time, so I don't think

Re: Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-14 Thread Steve Suehring
You are correct insofar as it triggers at compile time for libpcap, the configure script to be exact. I grabbed a copy of the trojan'ed libpcap and compiled it in a sandbox machine. You can do a strings of the compiled libpcap.a and grep for 1963. Doing so yields these results:

Re: Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-14 Thread Tim Haynes
Steve Suehring [EMAIL PROTECTED] writes: You are correct insofar as it triggers at compile time for libpcap, the configure script to be exact. I grabbed a copy of the trojan'ed libpcap and compiled it in a sandbox machine. You can do a strings of the compiled libpcap.a and grep for 1963.

Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-13 Thread Lupe Christoph
Hi! Please read http://www.hlug.org/modules.php?op=modloadname=Newsfile=articlesid=6mode=threadorder=0thold=0 Is Debian affected? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be

Re: Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-13 Thread Lionel Elie Mamane
On Wed, Nov 13, 2002 at 08:15:58PM +0100, Lupe Christoph wrote: Is Debian affected? I checked a few hours ago, and it was not, at least the mirror I'm using. -- Lionel msg07715/pgp0.pgp Description: PGP signature

Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-13 Thread Lupe Christoph
Hi! Please read http://www.hlug.org/modules.php?op=modloadname=Newsfile=articlesid=6mode=threadorder=0thold=0 Is Debian affected? Thanks, Lupe Christoph -- | [EMAIL PROTECTED] | http://www.lupe-christoph.de/ | | Big Misunderstandings #6398: The Titanic was not supposed to be

Re: Latest libpcap tcpdump sources from tcpdump.org contain a trojan

2002-11-13 Thread Lionel Elie Mamane
On Wed, Nov 13, 2002 at 08:15:58PM +0100, Lupe Christoph wrote: Is Debian affected? I checked a few hours ago, and it was not, at least the mirror I'm using. -- Lionel pgpRBCwvNmdOx.pgp Description: PGP signature