Internet security experts issued a warning Wednesday that some copies of the source code for Sendmail have been hacked by an intruder and now contain a Trojan horse.

In an advisory, the Computer Emergency Response Team (CERT) Coordination Center said the Trojan horse versions of Sendmail contain malicious code that is run during the process of building the popular software.

CERT said the files sendmail.8.12.6.tar.Z and sendmail.8.12.6.tar.gz were modified to include the malicious code and issued a warning to sites that employ, redistribute, or mirror the Sendmail package to "immediately verify the integrity of their distribution."

The Trojan would let an intruder operating from the remote address specified in the malicious code gain unauthorized remote access to any host that compiled a version of Sendmail from this Trojan horse version of the source code, the group said. "The level of access would be that of the user who compiled the source code."

"It is important to understand that the compromise is to the system that is used to build the Sendmail software and not to the systems that run the Sendmail daemon. Because the compromised system creates a tunnel to the intruder-controlled system, the intruder may have a path through network access controls," CERT added.

The Sendmail Consortium, which serves as a resource for the freeware version of Sendmail, confirmed the hack. "If you download the Sendmail distribution you MUST verify the PGP signature. Do NOT use Sendmail without verifying the integrity of the source code," the Consortium said.

Because of the attack, the Consortium's FTP server was unavailable Wednesday morning but legitimate copies of the source were available via HTTP.

CERT said the malicious code that was added to the Sendmail source forks a process that connects to a fixed remote server on 6667/tcp. "This forked process allows the intruder to open a shell running in the context of the user who built the Sendmail software," the outfit warned.

It said there was no evidence to suggest the process is persistent after a reboot of the compromised system. "However, a subsequent build of the Trojan horse Sendmail package will re-establish the backdoor process," CERT added.

The compromised files began to appear in Sendmail downloads on or around September 28, 2002, CERT said, noting that the Sendmail development team disabled the compromised FTP server on October 6.

"It does not appear that copies downloaded via HTTP contained the Trojan horse; however, the CERT/CC encourages users who may have downloaded the source code via HTTP during this time period to make the necessary verifications.

Sendmail, which is freely distributed, is by far the most popular MTA (message transport agent) on the Internet.