util-linux-2.9g compromised

As posted by Andries Brouwer to C.O.L.A., January 24, 1999 and also on linux-kernel.

I just learned that
ftp://ftp.win.tue.nl/pub/linux/util/util-linux-2.9g.tar.gz
has been compromised

(so that 1. It gives anybody who logs in with name #!sh
a root shell, and 2. It mails usernames and passwords
to wlogain@hotmail.com).

Probably you do not want to use this enhanced version.
The original version has been put back.
It has md5sum
ab409a6ac5a775a4b04b8e27f6c86933  util-linux-2.9g.tar.gz

I am not aware of anything else that was changed, but
of course this means for the time being that anything
found on this machine must be regarded as suspect.

Andries - aeb@cwi.nl


[PS I would be interested in finding precisely when
this was done. If you got a non-corrupt version
recently, could you mail me date and time?]

An independent announcement by Andries Brouwer of the util-linux security breach was posted to the linux-kernel list and is published on LWN/daily.