Skip to content
Fencer Vulns
high 7.5

CVE-2006-6576 in the critical feed json

Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash)…

published 2006-12-15 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6559

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
67.2%
EPSS 67.2% chance of exploitation in 30 days, percentile 99.3%
public exploits
4
Metasploit, Exploit-DB

Summary

Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command. NOTE: it was later reported that 4.70 is also affected. NOTE: the USER vector is already covered by CVE-2005-0634.

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/windows/ftp/goldenftp_pass_bof)

Exploit prediction

67.22% chance of exploitation in the next 30 days, higher than 99.3% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/windows/ftp/goldenftp_pass_bof GoldenFTP PASS Stack Buffer Overflow metasploit exploit, average rank, 2011-01-23
  • EDB-49629 Golden FTP Server 4.70 - 'PASS' Buffer Overflow (2) remote, 2021-03-09
  • EDB-17355 Golden FTP Server 4.70 - PASS Stack Buffer Overflow (Metasploit) remote, 2011-06-02
  • EDB-16036 Golden FTP Server 4.70 - 'PASS' Buffer Overflow remote, 2011-01-23
  • packetstormsecurity.com http://packetstormsecurity.com/files/161711/Golden-FTP-Server-4.70-Buffer-Overflow.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.