CVE-2006-6171: High severity Proftpd Project Proftpd vulnerability
DISPUTED ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6171?
CVE-2006-6171 has a low severity rating due to its buffer underflow vulnerability in ProFTPD.
How do I fix CVE-2006-6171?
To fix CVE-2006-6171, ensure you upgrade to ProFTPD version 1.3.1 or later where the issue is resolved.
What versions of ProFTPD are affected by CVE-2006-6171?
ProFTPD version 1.3.0a and earlier versions are affected by CVE-2006-6171.
What is the nature of the vulnerability in CVE-2006-6171?
CVE-2006-6171 is a buffer underflow vulnerability caused by improper buffer size limit settings.
Is CVE-2006-6171 actively being exploited?
At the time of reporting, CVE-2006-6171 was disputed, and there have been no confirmed active exploits.