Someone has inserted a Trojan horse into a recent version of the source code for the widely deployed Sendmail package, exposing an unknown number of servers to remote compromise.
The files Sendmail.8.12.6.tar.gz and Sendmail.8.12.6.z, available from the open source Sendmail Consortium, are both compromised, according to an advisory released late Tuesday by the CERT Coordination Center. Currently, CERT officials say that it appears only files downloaded via the ftp.sendmail.org server contain the malicious code.
The Trojaned version of the Sendmail package began showing up on Sept. 28 and security officials are unsure how many users downloaded the corrupted files before the FTP server hosting them was disabled on Sunday.
The Trojan executes during the process of building software after it is downloaded. Once executed, the code spawns a process that connects to a remote server via TCP port 6667. The process allows a remote attacker to open a shell on the compromised server. The shell runs in the context of the user who built the Sendmail software on the local system.
A reboot of the system halts the malicious process.
For users who have downloaded the malicious version of Sendmail, only the server on which the code was compiled—not the servers running the finished Sendmail daemon—would be compromised.
Written in 1981 by a student at the University of California at Berkeley, Sendmail is by far the most popular mail transfer agent on the Internet, running on upwards of 75 percent of mail servers, by some estimates. It is available as freeware from the Sendmail Consortium. Eric Allman, Sendmails author, is still involved in the development effort and is also the CTO at Sendmail Inc., which sells add-on products and solutions for the server.
There are two ways to determine whether youve downloaded a compromised copy: verifying the PGP signature or the MD5 checksum of the file. The Trojaned version did not have an updated PGP signature.
The PGP signature and checksum are included in the CERT advisory, available here .
The Sendmail Consortiums FTP server is still unavailable as of Wednesday morning, but clean source code can be downloaded via HTTP.
- More Security Coverage