From owner-freebsd-bugs  Thu Jun 26 08:13:06 1997
Return-Path: <owner-bugs>
Received: (from root@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id IAA25368
          for bugs-outgoing; Thu, 26 Jun 1997 08:13:06 -0700 (PDT)
Received: (from gnats@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id IAA25293;
          Thu, 26 Jun 1997 08:11:37 -0700 (PDT)
Resent-Date: Thu, 26 Jun 1997 08:11:37 -0700 (PDT)
Resent-Message-Id: <199706261511.IAA25293@hub.freebsd.org>
Resent-From: gnats (GNATS Management)
Resent-To: freebsd-bugs
Resent-Reply-To: FreeBSD-gnats@FreeBSD.ORG, admin@arces.net
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.5/8.8.5) id IAA25121;
          Thu, 26 Jun 1997 08:07:11 -0700 (PDT)
Message-Id: <199706261507.IAA25121@hub.freebsd.org>
Date: Thu, 26 Jun 1997 08:07:11 -0700 (PDT)
From: admin@arces.net
To: freebsd-gnats-submit@FreeBSD.ORG
X-Send-Pr-Version: www-1.0
Subject: misc/3959: files in /usr/local/etc are randomly becoming uuencoded other files or directories (changing themselves) and crashing the machine.
Sender: owner-bugs@FreeBSD.ORG
X-Loop: FreeBSD.org
Precedence: bulk


>Number:         3959
>Category:       misc
>Synopsis:       files in /usr/local/etc are randomly becoming uuencoded other files or directories (changing themselves) and crashing the machine.
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jun 26 08:10:01 PDT 1997
>Last-Modified:
>Originator:     Adrian Goins
>Organization:
Darkangel Dementia
>Release:        2.2.1
>Environment:
FreeBSD thorn.arces.net 2.2.1-RELEASE FreeBSE 2.2.1-RELEASE #0: Thu Jun 5 21:41:58 MDT 1997 root@myname.mydomain:/usr/src/sys/compile/THORN i386
>Description:
Over the last week i've noticed that files in /usr/local/etc are changing.  First it was some scripts i had written, which changed to uuencoded renditions of a ld.so file.  This morning I was receiving error messages from inetd that it couldn't execute tcpd.  /usr/local/etc/tcpd (which worked fine 7 hours ago) had become a directory with lib files in it.  Twenty minutes later (just a second ago), it's now a link to my anonymous ftp directory.  I run a secure site, so this isn't a crack, especially since you can't get to my machine anymore (since inetd can't execute tcpd).
>How-To-Repeat:
I don't know how to.  It's just happening randomly.  I"m going to make another backup of my crucial stuff and reinstall with 2.2.2-RELEASE.
>Fix:
Yeah.  Right.  Format the machine, I reckon.
>Audit-Trail:
>Unformatted: