X-Spam-Check-By: sourceware.org
Date: Mon, 16 Jul 2007 15:10:29 -0400 (EDT)
From: Igor Peshansky <pechtcha AT cs DOT nyu DOT edu>
Reply-To: cygwin AT cygwin DOT com
To: Louis Kruger <lpkruger AT cs DOT wisc DOT edu>
cc: cygwin AT cygwin DOT com
Subject: Re: hacked package on server
In-Reply-To: <469BBF7F.9060504@cs.wisc.edu>
Message-ID: <Pine.GSO.4.63.0707161505230.18589@access1.cims.nyu.edu>
References: <469B9A27 DOT 3090406 AT cs DOT wisc DOT edu> <Pine DOT LNX DOT 4 DOT 58 DOT 0707161245430 DOT 3644 AT dargo DOT trilug DOT org>  <469BBF7F DOT 9060504 AT cs DOT wisc DOT edu>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Precedence: bulk
List-Id: <cygwin.cygwin.com>
List-Unsubscribe: <mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

On Mon, 16 Jul 2007, Louis Kruger wrote:

> > > As the package installed, I saw some strange behavior, I'm worried
> > > it might have been some kind of trojan.
> >
> >   Are you able to actually describe "strange behaviour"
>
> It crashed the setup program, which seemed to indicate it was installing
> strangely named files.  It also corrupted the cygwin package directory.
> I could not run the setup program again even using a different mirror
> until I cleaned out the file /etc/setup/vim.lst.gz.

Ah, now we're getting somewhere.  Can you please attempt the installation
again and save the copy of the vim.lst.gz (and post it as an attachment)?
Setup should not crash on corrupted packages -- the fact that it did
probably indicates a bug in the bzip2 library or in the setup package
handling code.

> Your evidence seems to indicate that it is simple corruption rather than
> tampering.  I am pleased to see that.

Well, if it *were* some kind of trojan or virus, the corrupted executables
would come into play when *invoking* vim, not when attempting to install
it.
	Igor
-- 
				http://cs.nyu.edu/~pechtcha/
      |\      _,,,---,,_	    pechtcha AT cs DOT nyu DOT edu | igor AT watson DOT ibm DOT com
ZZZzz /,`.-'`'    -.  ;-;;,_		Igor Peshansky, Ph.D. (name changed!)
     |,4-  ) )-,_. ,\ (  `'-'		old name: Igor Pechtchanski
    '---''(_/--'  `-'\_) fL	a.k.a JaguaR-R-R-r-r-r-.-.-.  Meow!

Belief can be manipulated.  Only knowledge is dangerous.  -- Frank Herbert

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/