Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Hank Leininger
Re: Questionable CVE's reported against dnsmasq
oss-sec mailing list archives From: Hank Leininger <hlein () korelogic com> Date: Mon, 27 Oct 2025 17:15:09 -0600 [ Replying to Michael because this is a perfect jumping-off point, not because I'm saying anything he doesn't know.
Re: Update on the distro-backdoor-scanner effort
oss-sec mailing list archives From: Hank Leininger <hlein () korelogic com> Date: Sun, 28 Apr 2024 00:45:34 -0600 On 2024-04-28, Morten Linderud wrote: On Fri, Apr 26, 2024 at 02:06:16PM -0600, Hank Leininger wrote: - ~11k EndeavourOS/Arch packages Please just write Arch packages. There is no upstream collaboration from Endeavour on those 11k packages.
Re: Update on the distro-backdoor-scanner effort
oss-sec mailing list archives Re: Update on the distro-backdoor-scanner effort From: Hank Leininger <hlein () korelogic com> Date: Sun, 28 Apr 2024 00:34:36 -0600 On 2024-04-27, Jacob Bachmeyer wrote: - Output is manageable; able to rule out all hits not part of the actual xz-utils backdoors as false positives. This is what I would expect: the backdoor dropper appears to have been specifically developed for xz-utils, but could /possibly/ be adaptable to other compression tools.
Update on the distro-backdoor-scanner effort
oss-sec mailing list archives From: Hank Leininger <hlein () korelogic com> Date: Fri, 26 Apr 2024 14:06:16 -0600 tl;dr: We've pursued a number of avenues, with plans for more; so far no "smoking gun" of other backdoors of a similar vein; help wanted. So: what is this, where are we, what's next, what do we need, credits. What is this?
Re: finding similar compromises (was Re: From xz to ibus: ...
oss-sec mailing list archives From: Hank Leininger <hlein () korelogic com> Date: Tue, 2 Apr 2024 12:27:18 -0600 On 2024-04-02, Tavis Ormandy wrote: On 2024-04-02, Tavis Ormandy wrote: On 2024-04-01, HW42 wrote: Hi Jan, great that you are looking for further problems. (Just to be clear, I'm not associated with ibus in any way.) Yes, agreed. In the interests of discussing things in the open after just complaining about embargoes...
Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read
KL-001-2023-001: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read via sudo dig Title: Cisco ThousandEyes Enterprise Agent Virtual Appliance Arbitrary File Read via sudo dig Advisory ID: KL-001-2023-001 Publication Date: 2023.08.17 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2023-001.txt 1.
ftp.bitchx.org's ircii-pana-1.0c19.tar.gz is backdoored
From: Hank Leininger Date: Mon, 1 Jul 2002 11:42:34 -0400 (EDT) A few hours ago (1 AM US/Eastern time, July 1) we downloaded ircii-pana-1.0c19.tar.gz from ftp.bitchx.com (216.165.191.5) and reviewed the configure script before running it. It has essentially the same configure backdoor as fragroute-1.2.tar.gz[1] -- a TCP connection is made outbound, with a shell bound to it (a reverse telnet). This appears to retry/respawn once per hour.
CVS and ssh command injection (see CVE-2017-1000117, etc.)
CVS and ssh command injection (see CVE-2017-1000117, etc.) From: Hank Leininger Date: Thu, 10 Aug 2017 17:32:24 -0600 SSH command injection via -o... impacts CVS 1.12.x as well, if anybody still cares. The announcement for git mentions CVE-2017-1000117, CVE-2017-9800, and CVE-2017-1000116 for git, Subversion, Mercurial, but makes no mention of CVS.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Hank
Contact Hank, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack