hackad debian :s

[Master]

The Debian GNU/Linux project has admitted in a press release today that a hacker had compromised one of their internal servers.
Debian developer James Troup wrote in an e-mail addressed to the Debian community, shortly before 4am AEST: "Early this morning we discovered that someone had managed to compromise gluck.debian.org. We've taken the machine offline and are preparing to reinstall it. This means the following debian.org services are currently offline: cvs, ddtp, lintian, people, popcon, planet, ports, release.

Based on the results of our initial investigation we've locked down most other debian.org machines, limiting access to DSA only, until they can be fixed for what we suspect is the exploit used to compromise gluck."

James Troup said that he has initiated a security lock-down on most of Debian project’s other servers, enforcing limited access to the resources, as a precaution measure.

The embarassing security breach is not the first for Debian, as in November 2003 several of Debian's servers were similarly compromised and pulled offline. James Troup was also one of the people who investigated that incident.

We remind everyone that Debian Operating System is an association of individuals who have made common cause to create a free operating system. Among other versions of Linux, Debian is fairly unique, since unlike most distributions it isn't backed by any for profit venture and instead is an all volunteer organization. There is no for profit company, or business plan behind Debian, it is a wide ranging project along the lines of GNU.

[rancor]

Nu har de lagt in nån smarrig kod i lite olika ports och vips är hela Debian och nästa version av Ubuntu smiddad av trojaner

men seriöst. Det är inte första gången och det är ju direkt pinsamt om det är sådana säkerhetshål i Debian by default. Hoppas de berättar vad för fel de gjort och att det inte är en känd sårbarhet som kan drabba samtliga med en originalkonfguration.

[n4h0j]

Master: Länka gärna vidare till ursprungssidan! Det blir lättare att gå vidare om man är intresserad av att veta mer...

[rancor]

Länk:
http://www.zdnet.com.au/news/security/s ... 270,00.htm

[ozamosi]

Det är ju en kärn-bugg som upptäcktes sisådär 24 timmar tidigare som gör att alla användare kan få root-rättigheter. Det, tillsammans med någon utvecklares värdelösa lösenord, orsakade det här problemet.