Andries Brouwer writes:
> I just received the following letter:
> 
>     Date: Sun, 24 Jan 1999 04:01:55 -0500 (EST)
>     From: John Stange <building@cs.umd.edu>
>     Subject: util-linux compromised?
> 
>     I grabbed util-linux-2.9g yesterday from win.tue.nl, and discovered a
>     section of login.c that appears to send the host and uid of the user to a
>     hotmail address.  I imagine this isn't a standard feature. :>  Given that
>     the tcp wrappers archive was backdoored on that same server recently, you
>     might want to comb over the rest of your stuff as well, if any of it's
>     yours.
> 
>     -- John Stange
>     Staff World, 4120 AVW
>     x52720
> 
> and indeed, util-linux-2.9g had been replaced by a trojan version.
> Unfortunately this means that everything from ftp.win.tue.nl
> must be regarded as suspect for the moment.
> 
> I put a correct util-linux-2.9g.tar.gz back, with md5sum
>   ab409a6ac5a775a4b04b8e27f6c86933  util-linux-2.9g.tar.gz
> but of course, for the time being, nothing on this machine can be trusted.

FYI: I grabbed util-linux-2.9g at 22:00 UT, 23-DEC-1998 and it has no
sign of this trojan. In fact, the md5sum is the same as the one you
mentioned above.

				Regards,

					Richard....

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/