wu-ftpd tarball shipped backdoor

In April 1994, copies of the wuarchive ftpd source distribution were found to have been modified at trusted FTP distribution points. CERT's original advisory named versions 2.2 and 2.1f in its description, and warned that previous versions of the source may have been modified in a similar manner. The practical risk was severe for the era: administrators could compile what looked like normal upstream FTP daemon source and unknowingly install a root-level backdoor.

The delivery was the normal source-fetch and compile path for an FTP daemon. The attacker did not need to exploit a running wu-ftpd instance first, and did not need an account on the target: the back-door password was checked in the daemon's login path, before any authentication succeeded. The archive itself was the exploit vehicle, and the installed daemon carried the result.

CERT's advisory told sites running wuarchive ftpd to install version 2.3 or disable the FTP daemon. The original advisory published a checksum for 2.3, and its April 7 update published the exact authentication diff that identifies the known backdoor. A contemporary comp.unix.admin thread captured how quickly the incident became a reference point for open-source distribution trust: operators discussed the backdoored FTP daemon, compared it with earlier trusting-trust ideas, and treated trusted FTP distribution channels as the compromised boundary.

The risk was amplified by where wu-ftpd ran. FTP servers were public-facing infrastructure, often built locally by administrators and run with privileges that made a source-level backdoor immediately valuable. Once the archive was trusted, the attacker did not need a second delivery mechanism.