2 messages in net.sourceforge.lists.courier-maildrop[maildropl] authlib bug - POSSIBLE TR...
FromSent OnAttachments
Peter DiffeyMar 24, 2003 4:01 pm 
Sam VarshavchikMar 24, 2003 5:22 pm 
Actions with this message:
Paste this link in email or IM:
Paste this link in email or IM:
Atom feed for this thread
Paste this URL into your reader:
Subject:[maildropl] authlib bug - POSSIBLE TROJANActions...
From:Peter Diffey (prdi@heroic.co.uk)
Date:Mar 24, 2003 4:01:41 pm
List:net.sourceforge.lists.courier-maildrop

It seems that there is a serious bug in the courier-imap authdaemon - at least that seems to my first impression.

I did a standard configure/make/install of courier-imap-1.7.1.20030319.tar.tar

My system is MDK 8.2

thereafter I found that my system security was wide open, and no passwords are required for telnet, rsh or anything else.

I noticed that the /usr/lib/authlib/auth* executables have been replaced, this seems to have been done by authlib/Makefile.am

I believe that the authdaemon may have been hacked

It could of course be some sort of installation failure, however this in itself is dangerous, and is potentially as damaging as a trojan.

Please investigate

Pete

--------------------------------- Peter Diffey Unix Problem Solver Mobile +44 7979 546119