We had a reader report seeing exploit attempts related to a new ProFTPd authentication vulnerability.

When a backend database (mysql and reportedly postgres) is used for authentication with ProFTPd 1.3.1 and later
with NLS support enabled there is a SQL injection vulnerability involving a specially crafted username and password combination to grant access as any user. (The LIMIT statement can be used to select the nth account in the users table).

http://bugs.proftpd.org/show_bug.cgi?id=3173

Version 1.3.2 reportedly addressed this issue, however packaged distributions may still be vulnerable (a Gentoo user running 1.3.2rc2 reported a working exploit).
The proftpd bug site also shows a patch for 1.3.1.

This information was all released on BugTraq yesterday.

Its also worth noting that the kiddies are alive and well and trying these attacks as well.
We've heard of attacks involving both the true exploit as well as one involving a published typo.

So check your ftp servers (and those running unsanctioned by your staff) and get patched if needed.
Searching for the string "SELECT" or "USER" in your logs may also be helpful.

And feel free to share any logs or experiences via our contact form if you are seeing this type of attack.

Robert
SANS ISC Handler on Duty