VulnerabilityModified

CVE-2006-6171

NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure.

HIGH 7.5EPSS 9.66%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (9.66%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 9.66% probability · 95th percentile
CISA KEV: Not listed
Affected: proftpd project/proftpd
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.