home contents changes options help subscribe

We (GNU Savannah and the FSF) value transparency, so here are the details on this page.

Recap

There's been a SQL SELECT injection leading to a leak of unsalted MD5 account passwords, some of them discovered through online passwords recovery services, leading in turn to project membership and admin access, used for vandalism on the 'www' project that backs www.gnu.org.

www.gnu.org normally serves static pages, but PHP was found enabled, so crackers installed a reverse shell there as well.

Root access is separately maintained and no evidence of root access was found.

No other exploitable SQL injection has been found in Savane so far, thanks to the SQL parametrization work done back in 2007.

To be safe, we've reinstalled the system and restored the data from a trusted backup, November 23th circa 12:00 GMT.

Counter-measures

In progress:

Thanks to FSF sysadmins Bernie Innocenti and Ward Vandewege, Savannah Hackers Sylvain Beucler, Brian Gough, Michael J. Flickinger, Jim Meyering; Openwall hacker Solar Designer; Savannah users for their support.

Timeline