z3 Networks Ltd.

In what is a rare security breach, as well as what amounts to bad news coming from Redhat there’s been a possible compromise of repository files used for updates.  If you don’t have any idea what Linux or Redhat is  then you probably haven’t heard this.  If you’re an IT administrator and haven’t heard this, then you better catch up quick.  If you work in IT security and haven’t already done this, get a new job.Read more here: http://www.securityfocus.com/news/11532

As noted @ http://www.redhat.com/security/data/openssh-blacklist.html

Last week Red Hat detected an intrusion on certain of its computer systems and took immediate action. While the investigation into the intrusion is on-going, our initial focus was to review and test the distribution channel we use with our customers, Red Hat Network (RHN) and its associated security measures. Based on these efforts, we remain highly confident that our systems and processes prevented the intrusion from compromising RHN or the content distributed via RHN and accordingly believe that customers who keep their systems updated using Red Hat Network are not at risk. We are issuing this alert primarily for those who may obtain Red Hat binary packages via channels other than those of official Red Hat subscribers.”

RedHat has have provided a shell script which lists the affected packages and can verify that none of them are installed on a system:

root@server [~]# wget https://www.redhat.com/security/data/openssh-blacklist-1.0.sh

The script has a detached GPG signature from the Red Hat Security Response Team (key) so you can verify its integrity:

root@server [~]# wget https://www.redhat.com/security/data/openssh-blacklist-1.0.sh.asc

This script can be executed either as a non-root user or as root. To execute the script after downloading it and saving it to your system, run the command:

root@server [~]# bash ./openssh-blacklist-1.0.sh

If the script output includes any lines beginning with “ALERT” then a tampered package has been installed on the system. Otherwise, if no tampered packages were found, the script should produce only a single line of output beginning with the word “PASS”, as shown below:

root@server [~]# bash ./openssh-blacklist-1.0.sh
PASS: no suspect packages were found on this system

The script can also check a set of packages by passing it a list of source or binary RPM filenames. In this mode, a “PASS” or “ALERT” line will be printed for each filename passed; for example:

root@server [~]# bash ./openssh-blacklist-1.0.sh openssh-4.3p2-16.el5.i386.rpm
PASS: signature of package “openssh-4.3p2-16.el5.i386.rpm” not on blacklist

Related posts:

1. Redhat Release Bugfix: CentOS RPM Updates Still Behind
2. To suPHP or not to suPHP? That is not really a question…