Daily cyber threats and internet security news: network security, online safety and latest security alerts
January 29th, 2011

Several SourceForge Servers Breached, All Passwords Are Being Reset

SourceForge, the world’s largest open source software repository, has reset the password for all of its users following a successful attack against its infrastructure. SourceForge is operated by Geeknet, the company that also owns and runs Slashdot, freshmeat and ThinkGeek. The SourceForge team discovered the security breach on Thursday when exploits were found uploaded on several servers.

A preliminary investigation revealed the attack originated on the CVS hosting server, but the actual attack vector has not been identified yet. As a result of the incident, some functionality was immediately suspended, including CVS hosting, web-based source code browsing (ViewVC), the capability to upload new releases and the Interactive Shell services.

A subsequent update posted on the site’s official blog did not reveal any more information except that the team now better understands what happened and how it can prevent it in the future.

An email went out today to all users informing them that their passwords have been reset as a precaution.

“Our investigation uncovered evidence of password sniffing attempts. We have no evidence to suggest that your password has been compromised. But, what we definitely don’t want is to find out in 2 months that passwords were compromised and we didn’t take action,” the SourceForge team wrote.

People will have to go through the email-based password recovery process in order to set a new password. Users who no longer have access to the email address on record or who don’t remember the answer to their security question, can use an alternative form.

Meanwhile, work continues to determine the full extent of the compromise, restore data from backups and validate the security of disabled services before bringing them back online.

Credit: News

Share this item with others:

More on CyberInsecure:
  • PlentyOfFish Resets User Passwords After Registration Details Theft
  • Database Breached, Admins Reset Passwords For All Members
  • Critical Password-Reset Forgery Vulnerability In Joomla
  • Exposed Clear Text Users Passwords During Server Error
  • Sony PlayStation Network Breached, 77 Million Users Private Data Stolen

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Several SourceForge Servers Breached, All Passwords Are Being Reset

    One Response to “Several SourceForge Servers Breached, All Passwords Are Being Reset”

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.