CERT Advisory CA-1999-01 Trojan horse version of TCP Wrappers

Original issue date: January 21, 1999
Last revised: January 22, 1999

A complete revision history is at the end of this file.

The original release of this advisory contained an error. Please take note of the changes mentioned in the revision history section at the end of this file.

The CERT Coordination Center has received confirmation that some copies of the source code for the TCP Wrappers tool (tcpd) were modified by an intruder and contain a Trojan horse.

We strongly encourage sites running the TCP Wrappers tool to immediately verify the integrity of their distribution.

I. Description

TCP Wrappers is a tool commonly used on Unix systems to monitor and filter connections to network services.

The CERT Coordination Center has received confirmation that some copies of the file tcp_wrappers_7.6.tar.gz have been modified by an intruder and contain a Trojan horse. This file contains the source code for TCP Wrappers version 7.6. This Trojan horse appears to have been made available on a number of FTP servers since Thursday, January 21, 1999 at 06:16:00 GMT. Copies downloaded prior to this time are not affected by this particular trojan horse.

The Trojan horse version of TCP Wrappers provides root access to intruders initiating connections which have a source port of 421. Additionally, upon compilation, this Trojan horse version sends email to an external address. This email includes information identifying the site and the account that compiled the program. Specifically, the program sends information obtained from running the commands 'whoami' and 'uname -a'.

II. Impact

An intruder can gain unauthorized root access to any host running this Trojan horse version of TCP Wrappers.

Note: If you have already installed a Trojan horse version of TCP Wrappers, intruders can identify your site using information contained in this advisory. Please read the "Solution" section and take appropriate action to protect your site as soon as possible.

III. Solution

We encourage sites who downloaded a copy of the TCP Wrapper after Thursday, January 21, 1999 at 06:16:00 GMT to verify the authenticity of their TCP Wrapper distribution, regardless of where it was obtained.

You can use the following MD5 checksums to verify the integrity of your TCP Wrappers distribution:

Correct version:  
    tcp_wrappers_7.6.tar.gz 
        MD5  = e6fa25f71226d090f34de3f6b122fb5a
        size = 99438
    tcp_wrappers_7.6.tar
        MD5  = 5da85a422a30045a62da165404575d8e
        size = 360448

Trojan Horse version:        
    tcp_wrappers_7.6.tar.gz 
        MD5  = af7f76fb9960a95a1341c1777b48f1df
        size = 99186

Appendix A provides checksums for the individual files within the distribution.

It is not sufficient to rely on the timestamps of the file when trying to determine whether or not you have a copy of the Trojan horse version.

Additionally, the file tcp_wrappers_7.6.tar.gz is distributed with the detached PGP signature tcp_wrappers_7.6.tar.gz.sig.

Wietse Venema is the author and maintainer of the TCP Wrappers distribution.You can verify the integrity and authenticity of your distribution with Wietse Venema's PGP public key. We have included a copy of his PGP public key below. Note that the Trojan horse version was not signed, and that Wietse Venema's PGP key was not compromised in any way.

As a workaround, until you are able to verify your copies of TCP Wrappers, you can block inbound connections with a source port of 421 at your network perimeter. However, it is possible that some operating systems or software may use port 421 in legitimate connections. Thus, it is possible that some legitimate connections might be blocked.

Where to Get TCP Wrappers

Wietse Venema has moved the primary FTP archive for TCP Wrapper source to a different location. The primary archive is now located at

ftp://ftp.porcupine.org/pub/security/

Sites that mirror the TCP Wrapper source code are encouraged to update their mirroring procedures.

Wietse Venema expresses his gratitude to his former employer, Eindhoven University, for making possible the development and distribution of the TCP Wrapper software, and appreciates the support from system administrators of the department of mathematics and computing science.

Additionally, we have verified that the distribution of TCP Wrappers offered by the CERT Coordination Center at ftp.cert.org was not involved in this activity. TCP Wrappers is available from our FTP site at

ftp://ftp.cert.org/pub/tools/tcp_wrappers/tcp_wrappers_7.6.tar.gz
MD5 checksum: e6fa25f71226d090f34de3f6b122fb5a

Wietse Venema's PGP Public Key

Appendix A - Checksums

This appendix provides checksums for the individual files within the TCP Wrappers distribution.

MD5 (BLURB) = 627fc45308e852c446c3606647fa8c34
MD5 (Banners.Makefile) = e53315d5713278df908248602b129955
MD5 (CHANGES) = ff08c72b8c9c8d56ba9bf3e90d477639
MD5 (DISCLAIMER) = 071bd69cb78b18888ea5e3da5c3127fa
MD5 (Makefile) = 0037774577650534f898949d892144ec
MD5 (README) = 2452fb4f9d06500ec0634d7b64aaf76b
MD5 (README.IRIX) = 36603b049d5f89a26a300825c3021310
MD5 (README.NIS) = 147a07f2d3e673121dec4975849994e8
MD5 (clean_exit.c) = 1bac137fdc9c151351c0b33c9026421f
MD5 (diag.c) = 8f3d561785f3314a35a9de09d11ccdaa
MD5 (environ.c) = 9fa4c0f2fff89d00a4b1283730eab739
MD5 (eval.c) = b4fbd49308d5a8f77315167a4ee10339
MD5 (fakelog.c) = b329ab5443158e4c79f55710f9a675d0
MD5 (fix_options.c) = 99f3cb7841d8bf941bf6750fd7a96df1
MD5 (fromhost.c) = d880bab3c12c4109e95cdd69470e4ea3
MD5 (hosts_access.3) = 7993a6a2a27f729254bf29c13f48e9ab
MD5 (hosts_access.5) = 67085bc60fb9cbb70be7cb6490002923
MD5 (hosts_access.c) = cec0cba4a2df178e8857510704cc38f3
MD5 (hosts_ctl.c) = edad608818ee499ad0497dbabad43227
MD5 (hosts_options.5) = c4920a00f777844c6e8136e52e260264
MD5 (inetcf.c) = 02ccca613950bfe18706d0c39cbca9ea
MD5 (inetcf.h) = 2a7ac52919ccece4946943067455b1d8
MD5 (misc.c) = b74358d00ad758286a44c933fee4eda2
MD5 (miscd.c) = 720b62d42e8162cb7b696002e56ece6e
MD5 (mystdarg.h) = ce79d3c00d2ad46db810610c573bce2a
MD5 (myvsyslog.c) = 619fd9232e456e8ab75625f25dd58952
MD5 (ncr.c) = dc5262ae64eb1e3305bcfdc00e8fb9c9
MD5 (options.c) = 8b27d55628eb2b666b27f015ee2182b0
MD5 (patchlevel.h) = 92e06ff46922390163fdb46af95894f4
MD5 (percent_m.c) = 721472d1cc7cc8d4960d800057ed8ec1
MD5 (percent_x.c) = a406be699b48a19fb741fe8f31732698
MD5 (printf.ck) = 7dafed0315ad74bc7a28e7d747f29819
MD5 (ptx.c) = 9ab79f1b51877bbeeac82db794b25ad9
MD5 (refuse.c) = 5f2c0874378f640a86897f5531616dc7
MD5 (rfc931.c) = e629b1f5cfdc97dc43301ed1186f7c37
MD5 (safe_finger.c) = 7e4a788b375b7b05a60d24cd0c83b0b3
MD5 (scaffold.c) = ce9473ec933a5478d3522a15223c48c2
MD5 (scaffold.h) = 6b9d803d78ec0a6946f329d5a9856b53
MD5 (setenv.c) = 44209db39c4d3a173d2933b04f67320e
MD5 (shell_cmd.c) = 57b7371b951329db7b5f699e99798164
MD5 (socket.c) = 00f0890b1bc3e453ce44ccd64223b0c5
MD5 (strcasecmp.c) = 1e72db28013fc87fedcdbc155d8ba7fa
MD5 (tcpd.8) = eaee4abbff9c2853b4e5122ec1fb7a1b
MD5 (tcpd.c) = a8255a587f31a38b4a7485a5c8d904a3
MD5 (tcpd.h) = 076cf6456199450a4b81aec77165c716
MD5 (tcpdchk.8) = ed7b220f6ac7906ae326ac8fa3d04a11
MD5 (tcpdchk.c) = fe8a07ff2642e8b55922e6be510b9ed3
MD5 (tcpdmatch.8) = 85bc0335c865954ca534c9a17c666b53
MD5 (tcpdmatch.c) = 8af6daf4a1e9d9935956f1d31e54ab4f
MD5 (tli-sequent.c) = 6266612530ec81b4c3f90cbe34fcd108
MD5 (tli-sequent.h) = 9e8d21063e9157e7c2a4e9e3e3281e8b
MD5 (tli.c) = 7efc6e3c9915d6e8ca762342b540573d
MD5 (try-from.c) = c6a00f028c9578a881018b505857a05d
MD5 (update.c) = 77c218e0e6366d2327f52068f863d12b
MD5 (vfprintf.c) = 332dc8be89d5a59abc3036b490ba07d0
MD5 (workarounds.c) = d1e7b5abf95067313b7668d8c10a2c5c

The CERT Coordination Center wishes to thank Wietse Venema for his assistance in resolving this problem and Roy Arends of CERT-NL for valuable input in constructing this advisory. Additionally, we would like to thank Jochen Bauer of the Institute for Theoretical Physics at the University of Stuttgart for identifying an error in an earlier version of this advisory.

Wietse Venema expresses his appreciation to Andrew Brown of Crossbar Security, Inc. for noticing that the TCP Wrapper source code had been tampered with, and for informing the author of the incident.

Revision History

Fri January 22, 1999   Modified to reflect that the Trojan horse
                       provides root access to intruders initiating
                       connections from source port of 421 as opposed
                       to a destination port of 421.

                       Added section indicating that the primary FTP
                       archive for TCP Wrapper source has changed.

                       Added an MD5 checksum and size for the correct
                       version of the file tcp_wrappers_7.6.tar.

                       Added MD5 checksums for individual files 
                       within the TCP Wrapper distribution.

Space shortcuts

Child pages