website-editors.gnome.org: Hacked.

Hi,

one of our hosted website has been hacked. The website-editors website 
was a leftover of some past experiments of moving www.gnome.org to 
Plone. For some reason the service has been kept up and running since 
several months without anyone looking at it, that means two things:

- the software has been left there unmaintained.
- no security fixes have been applied, thus the attackers used a 
  security hole on the Plone software to get access to the server.

We've been looking and reviewing the relevant log files and we 
didn't notice anything strange, but we plan to rebuild the machine 
really soon to be extremely sure no leftovers are there on the box 
anymore.

The host (socket) currently serves www.gnome.org, more details to come 
in the near future when it will be time to switch wgo to a new host.

-- 

Cheers,

Andrea

Debian Developer,
Fedora / EPEL packager,
GNOME Sysadmin,
GNOME Foundation Membership & Elections Committee Chairman

Homepage: http://people.gnome.org/~av

-- 
devel-announce-list mailing list
[email protected]
https://mail.gnome.org/mailman/listinfo/devel-announce-list

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBCAAGBQJP8v1aAAoJELCi8amz5hIsxmIQAINSJBS2nz+cBjHYTSZkFHRG
kswhWqx2MG7z6WL0RUQAUTN/72n63P8QmS2MDfklz2NtIExgICx+9g9trrAieVCZ
PrhMOph1wcWPaKNTEZgGKQecPflqTjOQdyEyTjQC6qOWLclKlgcJnx0Y6XiU73Mh
mObq/N97qc+ao6Ojjs8eqwIbpIVqmos9PwHAocWs4kni/O8kPvxjTDYxNdWgRvP2
U8+ccDv4XbLO85SvDbLX8dFfotJZrSE4NQaf7HMtxchAQqqPy4CE04UtxXVGB1Ju
HIJ9f+ckzKTRPqx7U3NcjVZuKUdtFZ7YEJ0lrMZtur6R6l4XiHPEyeEOmW2SK9be
SX/gSxLogiw/4wHTzOwi+ALzE/sLGIO8kAHEpgEPpNnhT/MD/9tbM7BQ4VB4HM7u
ItZBTlBR0cN9K3v56qYyIft3dlcz/6UIu1cDI9LkP8MYC4Eg+VaL4xJmMdX8cnHg
dcgRxqp0Ra8gtOsv8ErQmEHC67CFqdi4VLDCWbDvs9/hlSA2D4w9QMvWR4POUw0L
ayk/NLBaWFUQ7xOEQV06RjGJ4Ub3EsFM3jpDy8/yom2OoCbrsnOjtRuk0v09uTa/
61q0HH09YVjC95Q9f9F04Fk/OQuEruM7LF9NIRWJYN3Q4evjDFUZzWof4co6U7AX
4mewUKXpF2FxyaevwuNF
=EyOm
-----END PGP SIGNATURE-----