CVE-2006-6171: proftpd_project proftpd
Vulnerability summary
CVE-2006-6171 is a high (CVSS 7.5) vulnerability in proftpd_project proftpd. EPSS estimates a 9.66% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities.
Timeline
- 30-11-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
9.66%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 9.66% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- proftpd< 1.2.10-15sarge2
- proftpd-dfsg< 1.3.0-13
Proftpd_project1 product
- proftpd≤ 1.3.0a
2 vendors · 3 products
References
15 links
- proftp.cvs.sourceforge.net/proftp/proftpd/src/main.c?r1=1.292&r2=1.293&sortby=dateX Refsource MISCVendor Advisory
- slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.502491Vendor AdvisoryX Refsource SLACKWARE