Sendmail Package Carrying Trojan Horse
It is unknown how many servers have been exposed to the malicious code.Someone has inserted a Trojan horse into a recent version of the source code for the widely deployed Sendmail package, exposing an unknown number of servers to remote compromise. The files Sendmail.8.12.6.tar.gz and Sendmail.8.12.6.z, available from the open source Sendmail Consortium, are both compromised, according to an advisory released late Tuesday by the CERT Coordination Center. Currently, CERT officials say that it appears only files downloaded via the ftp.sendmail.org server contain the malicious code. The Trojaned version of the Sendmail package began showing up on Sept. 28 and security officials are unsure how many users downloaded the corrupted files before the FTP server hosting them was disabled on Sunday.
The Trojan executes during the process of building software after it is downloaded. Once executed, the code spawns a process that connects to a remote server via TCP port 6667. The process allows a remote attacker to open a shell on the compromised server. The shell runs in the context of the user who built the Sendmail software on the local system.