CVE-2011-2523
📋 TL;DR
CVE-2011-2523 is a backdoor in vsftpd 2.3.4 that allows unauthenticated remote attackers to execute arbitrary commands via a shell opened on port 6200/tcp. This affects any system running the compromised version of vsftpd downloaded during a specific timeframe. The vulnerability provides complete system compromise.
💻 Affected Systems
- vsftpd
📦 What is this software?
Vsftpd by Vsftpd Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level access, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to data exfiltration, cryptocurrency mining, or botnet enrollment.
If Mitigated
Limited impact if vsftpd is not internet-facing and network segmentation restricts access to port 6200.
🎯 Exploit Status
Exploitation is trivial - connecting to port 6200 after triggering the backdoor provides shell access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: vsftpd 2.3.5 or later
Vendor Advisory: https://security.appspot.com/vsftpd.html
Restart Required: Yes
Instructions:
1. Stop vsftpd service. 2. Remove compromised vsftpd 2.3.4. 3. Download vsftpd 2.3.5 or later from official source. 4. Install new version. 5. Restart vsftpd service.
🔧 Temporary Workarounds
Block port 6200 with firewall
linuxPrevent access to the backdoor port
iptables -A INPUT -p tcp --dport 6200 -j DROP
iptables -A OUTPUT -p tcp --dport 6200 -j DROP
Disable vsftpd service
linuxStop the vulnerable service until patched
systemctl stop vsftpd
service vsftpd stop
🧯 If You Can't Patch
- Replace vsftpd with alternative FTP server software
- Implement strict network segmentation and firewall rules to isolate affected systems
🔍 How to Verify
Check if Vulnerable:
Check vsftpd version and build date: vsftpd -v 2>&1 | grep '2.3.4' and verify if downloaded during vulnerable timeframeCheck Version:
vsftpd -v 2>&1Verify Fix Applied:
Verify vsftpd version is 2.3.5 or later: vsftpd -v 2>&1 | grep -v '2.3.4'📡 Detection & Monitoring
Log Indicators:
- Unusual connections to port 6200 in system logs
- Failed authentication attempts followed by port 6200 connections
Network Indicators:
- Outbound connections from port 6200
- Unexpected traffic on port 6200
SIEM Query:
destination_port=6200 OR source_port=6200🔗 References
- http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
- https://access.redhat.com/security/cve/cve-2011-2523
- https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Execution.html
- https://security-tracker.debian.org/tracker/CVE-2011-2523
- https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805
- https://www.openwall.com/lists/oss-security/2011/07/11/5
- http://packetstormsecurity.com/files/162145/vsftpd-2.3.4-Backdoor-Command-Execution.html
- https://access.redhat.com/security/cve/cve-2011-2523
- https://packetstormsecurity.com/files/102745/VSFTPD-2.3.4-Backdoor-Command-Execution.html
- https://security-tracker.debian.org/tracker/CVE-2011-2523
- https://vigilance.fr/vulnerability/vsftpd-backdoor-in-version-2-3-4-10805
- https://www.openwall.com/lists/oss-security/2011/07/11/5
