A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. This backdoor allows remote, unauthenticated attackers to execute arbitrary shell commands with root privileges on the FTP server host. The hidden FTP command trigger can be invoked to exploit the vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2010-20103 |
Exploitation
To exploit this vulnerability, an attacker can connect to the affected ProFTPD server and invoke the hidden FTP command that triggers the backdoor. This allows the attacker to execute arbitrary commands on the server with root privileges, leading to a complete compromise of the system.
Affected Products
- ProFTPD 1.3.3c: The version of ProFTPD that was compromised, allowing for remote command execution.
Mitigation
To mitigate this vulnerability, users should upgrade to a secure version of ProFTPD that does not contain the backdoor. Additionally, monitoring and restricting access to FTP services can help prevent unauthorized exploitation.