CVE-2006-6171
- State
- Published
- Severity
- Not scored
- Published
- Nov 30, 2006
- Updated
- Aug 7, 2024
- Reserved
- Nov 30, 2006
Description
ProFTPD 1.3.0a and earlier does not properly set the buffer size limit when CommandBufferSize is specified in the configuration file, which leads to an off-by-two buffer underflow. NOTE: in November 2006, the role of CommandBufferSize was originally associated with CVE-2006-5815, but this was an error stemming from a vague initial disclosure. NOTE: ProFTPD developers dispute this issue, saying that the relevant memory location is overwritten by assignment before further use within the affected function, so this is not a vulnerability
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- DSA-1222vendor-advisory
- http://proftp.cvs.sourceforge.net/proftp/proftpd/src/main.c?r1=1.292&r2=1.293&sortby=date
- DSA-1218vendor-advisory
- 23207third-party-advisory
- SSA:2006-335-02vendor-advisory
- 23174third-party-advisory
- MDKSA-2006:217-1vendor-advisory
- 2006-0070vendor-advisory
- 23329third-party-advisory
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=214820
- 23184third-party-advisory
- 23179third-party-advisory
- GLSA-200611-26vendor-advisory
- OpenPKG-SA-2006.035vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.