10

CVE-2006-5815: proftpd project proftpd

Modified
AliasesDEBIAN-CVE-2006-5815
Published 08-11-2006Last modified 07-08-2024

Vulnerability summary

CVE-2006-5815 is a high (CVSS 10.0) vulnerability in proftpd project proftpd. EPSS estimates a 75.49% chance of exploitation in the next 30 days, higher than 99.5% of scored vulnerabilities. 3 public exploits are recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (exploit-database, 09-01-2011)

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
High · v2.0 (NVD)
EPSS score
75.49%
0%100%
Critical · +1.25 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits3exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
DSA-1222-1OPENSUSE-SU-2024:11196-1

Timeline

  1. 08-11-2006
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows remote attackers, probably authenticated, to cause a denial of service and execute arbitrary code, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

75.49%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

Increase +1.25 pp

From 74.23% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found
  • exploit-databaseremotelinuxVerified

    ProFTPd 1.2 < 1.3.0 (Linux) - 'sreplace' Remote Buffer Overflow (Metasploit)

    Maturity: weaponized

  • exploit-databaseremotelinuxVerified

    ProFTPd 1.3.0 - 'sreplace' Remote Stack Overflow (Metasploit)

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    ProFTPD 1.2 - 1.3.0 sreplace Buffer Overflow (Linux)

    exploit/linux/ftp/proftp_sreplace

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Debian1 product
  • proftpd-dfsg< 1.3.0-15
Proftpd project1 product

2 vendors · 2 products

References

26 links
Show all 26 references