Login Request a demo
Unscored severity · published Nov 30, 2006
CVE-2006-6170
Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute…
–
CVSS
17.1%
EPSS
No
On KEV
Description
Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in ProFTPD 1.3.0a and earlier, and possibly other products, allows remote attackers to execute arbitrary code via a large data length argument, a different vulnerability than CVE-2006-5815.
Exploitation
Is it being used?
Exploit prediction (EPSS)17.1% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Proftpd · Proftpd Project
through 1.3.0a · source: NVD
Affected product
PR
Proftpd
Proftpd Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-6170
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-6170
Exploit
http://elegerov.blogspot.com/2006/10/do-you-remember-2-years-old-overflow.html
Exploit
http://lists.grok.org.uk/pipermail/full-disclosure/2006-November/050935.html
Vendor Advisory
http://secunia.com/advisories/23141
secunia.com
http://secunia.com/advisories/23174
secunia.com
http://secunia.com/advisories/23179
secunia.com
http://secunia.com/advisories/23184
More from Proftpd
8.1
CVE-2026-35025
ProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR
6.5
CVE-2026-53994
ProFTPD mod_sftp Heap Buffer Overflow via Unsigned Integer Underflow and Size Truncation
–
CVE-2009-0542
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which…
–
CVE-2008-4242
ProFTPD 1.3.1 interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute…
–
CVE-2007-2165
The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same…