CVE-2006-6563

Public Exploit

Description

Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.

6.6

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 0.17%

Vendor Advisory mandriva.com Vendor Advisory openpkg.com Vendor Advisory gentoo.org Vendor Advisory trustix.org Vendor Advisory secunia.com

Affected: n/a n/a

References

Link	Tags
http://www.securityfocus.com/bid/21587	exploit vdb entry patch
http://www.mandriva.com/security/advisories?name=MDKSA-2006:232	vendor advisory
http://www.securityfocus.com/archive/1/454320/100/0/threaded	mailing list
http://www.proftpd.org/docs/NEWS-1.3.1rc1
http://www.coresecurity.com/?module=ContentMod&action=item&id=1594	patch exploit
http://www.securityfocus.com/archive/1/460648/100/0/threaded	mailing list
http://www.openpkg.com/security/advisories/OpenPKG-SA-2006.039.html	vendor advisory
https://www.exploit-db.com/exploits/3330	exploit
http://secunia.com/advisories/24163	third party advisory
http://secunia.com/advisories/23473	third party advisory
http://security.gentoo.org/glsa/glsa-200702-02.xml	vendor advisory
http://secunia.com/advisories/23371	exploit third party advisory patch vendor advisory
http://www.vupen.com/english/advisories/2006/4998	vdb entry
http://secunia.com/advisories/23392	third party advisory
http://www.securityfocus.com/archive/1/460756/100/0/threaded	mailing list
https://exchange.xforce.ibmcloud.com/vulnerabilities/30906	vdb entry
http://www.trustix.org/errata/2006/0074/	vendor advisory

Frequently Asked Questions

What is the severity of CVE-2006-6563?: CVE-2006-6563 has been scored as a medium severity vulnerability.
How to fix CVE-2006-6563?: To fix CVE-2006-6563, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-6563 being actively exploited in the wild?: It is possible that CVE-2006-6563 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.