util-linux source archive trojanized

On January 24, 1999, the util-linux 2.9g source archive on ftp.win.tue.nl was found to be a trojaned replacement; CERT later placed the trojan on the server between January 22 and January 24. The report came days after the tcp-wrappers compromise on the same server. The trusted FTP host, not a random mirror, was the failed boundary.

The modified archive changed login-utils/login.c, and the published diff also touched install-sh and the disk-utils and misc-utils Makefiles. A new checkname() path ran on the supplied username before any password was checked. If that username began with #!, the code built /bin/<name> and executed it. CERT put the consequence plainly: the change gave anyone with access to a login prompt the capability of executing commands. Brouwer was blunter. Anybody who logged in with the name #!sh got a root shell, no credentials required.

The same function also forked a reporting process. It resolved mail.hotmail.com, spoke SMTP, and sent host and UID data to a Hotmail address. It left /var/tmp/.fmlock0 as a marker and exposed HELO 127.0.0.1 as a simple detection string.

The maintainer restored a clean 2.9g archive and warned that nothing on the compromised machine should be trusted. CERT later folded util-linux into CA-1999-02 and advised users to move to util-linux 2.9h with signature verification. The lesson was plain: timestamps and familiar paths were not integrity.