stupid to think independantly to arrive to a conclusion to what most likely did happen with the Snort.org compromise.
Snort.org wasn't compromised, a shell server was.
Some good questions are:
1) If the intrusion were limited to a single "shellbox" then why did they
need to audit the code in CVS to see if it was backdoored?
The audits were performed after the rpc buffer overflow in Snort this past spring, no audit was performed as a result of the compromise because it didn't effect anything. I don't see why this is a tough problem for you, grep the code for whatever you're interested in or something, it's open source. In fact, I invite everyone to go through the code and check it themselves, it's all up there on snort.org all the way back to the initial release back in 1998.
-Marty
-- Martin Roesch - Founder/CTO, Sourcefire Inc. - (410)290-1616 Sourcefire: Snort-based Enterprise Intrusion Detection Infrastructure [EMAIL PROTECTED] - http://www.sourcefire.com Snort: Open Source Network IDS - http://www.snort.org
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
