A day after warning of multiple vulnerabilities in the OpenSSL protocol, the CERT Coordination Center (CERT/CC) issued an alert that some copies of the source code for the OpenSSH package contain a Trojan horse.

The security outfit warned that an unknown intruder modified files in the openssh-3.4p1.tar.gz, openssh-3.4.tgz and openssh-3.2.2p1.tar.gz to include malicious code and warned that mirrors of the OpenSSH download may be compromised. The main openBSD mirror was trojaned.

"We strongly encourage sites which employ, redistribute, or mirror the OpenSSH package to immediately verify the integrity of their distribution," CERT/CC said in the advisory.

Developers on security message boards say the malicious code does not appear sophisticated but could be remotely programmed to give intruders root access machines.

"When building the OpenSSH binaries, the trojan resides in bf-test.c and causes code to execute which connects to a specified IP address. The destination port is normally used by the IRC protocol. A connection attempt is made once an hour. If the connection is successful, arbitrary commands may be executed," the group warned.

It is the second major bug found in OpenSSH in the last few months. In June, serious flaws were found and fixed in versions 2.3.1p1 through 3.3 of the open-source tool, which is used by developers as a secure alternative to Telnet Rlogin, Rsh, and FTP.

The malicious files appear to have been placed on the FTP server which hosts ftp.openssh.com and ftp.openbsd.org between July 30 or 31, almost two full days before the OpenSSH development team could replace the Trojan horse copies with the original, uncompromised versions. That means the Trojan horse copy of the source code was available long enough for copies to propagate to sites that mirror the OpenSSH site, CERT warned.

"The Trojan horse versions of OpenSSH contain malicious code that is run when the software is compiled. This code connects to a fixed remote server on 6667/tcp. It can then open a shell running as the user who compiled OpenSSH," the Center said.

OpenSSH users are urged to go to the primary distribution site for the software at OpenSSH.com.