The wuarchive ftpd and ProFTPD are FTP servers used to transfer files over the internet. A buffer overflow vulnerability in these servers allows an attacker to execute arbitrary code on the server by sending a malicious string that gets logged, potentially leading to remote root access.
You're affected if you use wuarchive ftpd or ProFTPD versions 2.17 and earlier. To check if you're running one of these servers, run ftp -inv (for wuarchive ftpd) or proftpd -V (for ProFTPD).
Note: This is a niche software, so if you don't recognize the name, you're probably not affected. However, if your organization uses FTP servers for file transfers, it's essential to investigate further.
Immediate mitigations:
- Disable FTP access to your server (firewall it from the public internet)
- Audit log files for suspicious activity patterns
- Monitor for unauthorized login attempts