This message is intended to be somewhat of a teaching document and does not assume a high level of technical skill. I would be happy to receive any suggestions or corrections. The system in question is an unpatched Red Hat Linux 6.2 machine running as an ipchains firewall and IP masquerade server. The statd exploit attacks the remote procedure call application rpc.statd and opens up an interactive root shell on TCP port 39168. A more careful attacker would have left this directory intact but edited the specific log files to erase their tracks.
Patches are available on the redhat website.
The IP addresses are most likely other compromised systems that the attackers are using to break into other sites and could be one of the sites that was used to crack this box. The attacker then telnets to the port and has interactive root access. The SITE EXEC string appears in one of the previous password entry overflow logs, which is a known problem with this version of wu-ftp. Without detailed logs, it's hard to know exactly what the attacker did since they cleaned up some other commonly exploited services when they first logged in to the system. It's possible that the attacker gained some other means of initial access but evidence suggests that these FTP exploits were the means.