On Fri, 2011-09-02 at 12:56 +0200, Thorsten Kukuk wrote:
On Fri, Sep 02, Tomas Mraz wrote:
>
http://securitywatch.pcmag.com/hacking/287192-linux-kernel-site-compromised
>
> Does it affect us as we use the
ftp.kernel.org as the primary download
> repository for Linux-PAM sources?
Yes, the staging area for Linux-PAM is on
hera.kernel.org, but
the tar archives are identical to the local copy I have as backup.
So we are not affected.
As we probably cannot completely rule out the possibility that the
tarballs were temporarily modified by the attacker at some point of time
and then reverted back, perhaps we should announce that the users that
downloaded the Linux-PAM source tarballs during August should compare
them against the sources on the ftp as of today.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb