Re: Security Breach Alert - CVS Home File Download Area Compromised

[Arno Schuring]

> When I download a source "*.tar.gz" and corresponding "*.tar.gz.sig", I 
> get
> file sizes consistent with values on download page and a PGP signature 
> check
> reports a valid file.

I haven't been able to download cvs-1.11.18.tar.gz.sig, does not even create 
an empty file. When clicking 'info' on the download page, it says 'file 
size: 0.0'. This is using Firefox 1.0 on Windows XP.

md5 of the source:
fff9cf794701b27de56b907746176c71 *cvs-1.11.18.tar.gz

cvs-1.11.11-SunOS-5.8-i386.gz from cvshome.org is 708 kB (725.534 bytes)
cvs-1.11.18-SunOS-5.8-i386.gz from cvshome.org is 720 kB (737.299 bytes)

md5:
35608cc22fa1cae86f43cb9336a5e12e *cvs-1.11.11-SunOS-5.8-i386.gz
5d88c104ef5b35b2996a44fa34a39170 *cvs-1.11.18-SunOS-5.8-i386.gz

sig files are all 0.0 bytes when clicking 'info', even though the download 
page says they're 66 bytes:
FILE cvs-1.11.18-SunOS-5.8-i386.gz.sig (File size: 0.0)


For what it's worth:
fff9cf794701b27de56b907746176c71 *cvs-1.11.18.tar.gz
3986d5a825cfb82436e7934b4bf71287 *cvs-1.11.18-AIX.gz
35608cc22fa1cae86f43cb9336a5e12e *cvs-1.11.11-SunOS-5.8-i386.gz
5d88c104ef5b35b2996a44fa34a39170 *cvs-1.11.18-SunOS-5.8-i386.gz
dbaf26eb74d5d4fa5201bb82f0d858ac *cvs-1-11-17.zip
e07f84dceb46e0b5a8a12dabd648d8e1 *cvs-1.11.18-HP.gz
f91de7cbed9dedb794b078ee32a0ebf4 *cvs-1.11.18-SUN.gz

File sizes appear to match the sizes indicated on the download page.

I haven't been able to download any files at all using IE6 sp2. error 
message: "HTTP redirect failed"


HTH,
Arno