CVE-2010-20103
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.
- CVSS 4.0
- 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 5.09% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-912
- Affected
- proftpd/proftpd
- Source
- disclosure@vulncheck.com
References
- http://www.proftpd.org/Product
- https://advisories.checkpoint.com/defense/advisories/public/2011/cpai-2010-151.html/Third Party Advisory
- https://github.com/proftpd/proftpdProduct
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rbExploit, Third Party Advisory
- https://web.archive.org/web/20111107212129/http://rsync.proftpd.org/Release Notes
- https://www.exploit-db.com/exploits/15662Exploit, VDB Entry
- https://www.exploit-db.com/exploits/16921Exploit, VDB Entry
- https://www.vulncheck.com/advisories/proftpd-backdoor-command-executionThird Party Advisory
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/ftp/proftpd_133c_backdoor.rbExploit, Third Party Advisory
- https://www.exploit-db.com/exploits/15662Exploit, VDB Entry
- https://www.exploit-db.com/exploits/16921Exploit, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.