SecurityFocus: Clues, Vandalism, Litter Sendmail Trojan Trail

"The Trojan horse discovered in a distribution of the Sendmail open-source e-mail server has striking similarities to a backdoor planted in OpenSSH last summer, according to security experts who've analyzed the code. But missteps in the alerting process may have given the culprits a chance to cover their tracks.

"The sophisticated backdoor came to light Tuesday through an advisory from the government-funded Computer Emergency Response Team (CERT) Coordination Center. CERT warned that copies of version 8.12.6 of Sendmail downloaded between September 28th and October 6th from the Sendmail Consortium's public FTP server contained the backdoor.

"Once downloaded, the victim unwittingly activates the backdoor by compiling Sendmail from source code. The malicious code then establishes a secret control channel to a particular Internet host over TCP port 6,667, according to the CERT advisory..."

Complete Story

Related Stories:

• LinuxSecurity.com: Sendmail Trojan Horse(Oct 09, 2002)
• CrossNodes: Securing the Mail: Lock Spam and Viruses Out of Sendmail(Jul 18, 2002)