Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: ProFTPd SQL Authentication Vulnerability exploit activity SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
ProFTPd SQL Authentication Vulnerability exploit activity

We had a reader report seeing exploit attempts related to a new ProFTPd authentication vulnerability.

When a backend database (mysql and reportedly postgres) is used for authentication with ProFTPd 1.3.1 and later
with NLS support enabled there is a SQL injection vulnerability involving a specially crafted username and password combination to grant access as any user. (The LIMIT statement can be used to select the nth account in the users table).

Version 1.3.2 reportedly addressed this issue, however packaged distributions may still be vulnerable (a Gentoo user running 1.3.2rc2 reported a working exploit).
The proftpd bug site also shows a patch for 1.3.1.

This information was all released on BugTraq yesterday.

Its also worth noting that the kiddies are alive and well and trying these attacks as well.
We've heard of attacks involving both the true exploit as well as one involving a published typo.

So check your ftp servers (and those running unsanctioned by your staff) and get patched if needed.
Searching for the string "SELECT" or "USER" in your logs may also be helpful.

And feel free to share any logs or experiences via our contact form if you are seeing this type of attack.

SANS ISC Handler on Duty


49 Posts
Feb 11th 2009

Sign Up for Free or Log In to start participating in the conversation!