ProFTPD Backdoor Command Execution Vulnerability

A backdoor vulnerability has been introduced in ProFTPD version 1.3.3c, specifically in the source tarball distributed between November 28 and December 2, 2010. This backdoor allows remote, unauthenticated attackers to execute arbitrary shell commands with root privileges on the affected server. The malicious modification was made to the official ProFTPD FTP server software, which is widely used in various Linux distributions.

Impact

Exploitation of this vulnerability leads to unauthorized remote command execution with root privileges on the affected system.

Reproduction

The backdoor can be accessed by sending a specially crafted FTP command. Once the backdoor command is invoked, it executes the payload on the server with root privileges. This vulnerability can be reproduced by uploading a payload to the server and then using the backdoor to execute it.

Remediation

Users are advised to update to ProFTPD versions 1.3.3f or 1.3.4rc3, both of which are available on the official ProFTPD website.