Back door in ProFTPD FTP server

[J65nko]

From http://www.h-online.com/security/new...r-1146592.html

Unknown attackers penetrated the server hosting the open source ProFTPD FTP server project and concealed a back door in the source code. The back door provides the attackers with complete access to systems on which the modified version of the server has been installed.

On installation, the modified version informs the group behind the back door by contacting an IP address in the Saudi Arabia area. Entering the command 'HELP ACIDBITCHEZ' results in the modified server displaying a root shell.

[comet--berkeley]

This was also reported on the UK Register

http://www.theregister.co.uk/2010/12...pd_backdoored/

Here is a quote from the article:

John Morrissey, a member of the ProFTPD core team, said in an email sent Thursday afternoon that members "currently believe the vulnerability used to gain access to ftp.proftpd.org was previously announced and fixed in ProFTPD, but was unpatched on the system in question."