WineHQ access credentials harvested
Attackers have used phpMyAdmin, an open source database administration tool, to access the WineHQ project's database and harvest users' appdb and bugzilla access credentials. An incident report on the project's mailing list says that the attackers also obtained users' encrypted access passwords; whether the attackers will be able to crack these depends on their motivation and the strength of individual passwords, said the report. Therefore, the attackers can potentially also access other services if a WineHQ database user has used the same access credentials there.
The Wine developers say that they will be resetting every password and sending a message to all affected users. They note that externally accessing phpMyAdmin is no longer possible and that it currently remains unclear whether the intrusion was achieved via a security hole or a compromised administrator account. The developers also said that they believe that the attackers had no further system access. "We saw no evidence of any attempt to change the database", they added.
Wine (Wine Is Not an Emulator) is free open source software that allows users to run Windows applications on Linux and Unix by providing its own native replacements for Windows DLLs. Hosted on SourceForge, Wine source code is licensed under the LGPL. The Wine Project is sponsored by CodeWeavers, which also shares its own code updates with the Project.