ProFTPD Backdoor Unauthorized Access Vulnerability

Bugtraq ID:	45150
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2010 12:00AM
Updated:	Dec 03 2010 03:35AM
Credit:	Daniel Austin
Vulnerable:	ProFTPD Project ProFTPD 1.3.3c
Not Vulnerable:

ProFTPD Backdoor Unauthorized Access Vulnerability

ProFTPD is prone to an unauthorized-access vulnerability due to a backdoor in certain versions of the application.

Exploiting this issue allows remote attackers to execute arbitrary system commands with superuser privileges.

The issue affects the ProFTPD 1.3.3c package downloaded between November 28 and December 2, 2010.

The MD5 sums of the unaffected ProFTPD 1.3.3c source packages are as follows:

8571bd78874b557e98480ed48e2df1d2 proftpd-1.3.3c.tar.bz2
4f2c554d6273b8145095837913ba9e5d proftpd-1.3.3c.tar.gz

Files with MD5 sums other than those listed above should be considered affected.

ProFTPD Backdoor Unauthorized Access Vulnerability

An attacker can use readily available network utilities to exploit this issue.

The following exploit is available:

• /data/vulnerabilities/exploits/45150.rb

ProFTPD Backdoor Unauthorized Access Vulnerability

Solution:
The vendor released an advisory to address the issue. Please see the references for more information.

ProFTPD Backdoor Unauthorized Access Vulnerability

References:

• [Proftpd-user] ProFTPD ftp.proftpd.org compromise (ProFTPD)
  
• ProFTPD Homepage (ProFTPD)