A Computer Emergency Response Team (CERT) Coordination Center advisory said that illicit code added to the Sendmail package creates a back door when the program is compiled from its source code. Such a compromised program -- called a Trojan horse by security experts -- can leave networks exposed to attack and administrators unaware of the vulnerabilities.
The source code files of Sendmail 8.12.6 were apparently modified as far back as 28 September, according to the advisory. The Sendmail Consortium removed file transfer protocol (FTP) access to the server on Sunday. A safe version of the file can still be downloaded via the Web.
"If you download the Sendmail distribution you MUST verify the PGP signature," stated the consortium on its site. "Do NOT use Sendmail without verifying the integrity of the source code."
The added code links to a specific server on the Internet, said CERT in its advisory. The security group also recommends that anyone who downloads Sendmail verify the file's integrity.
Because only the act of compiling the file activates the hostile program code, restarting the Sendmail server seems to deactivate the backdoor.
