PT-2006-3368 · Freeftpd+2 · Freeftpd+2

Gerry Eisenhaur · Published 2006-05-16 · Updated 2018-10-18 · CVE-2006-2407

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WeOnlyDo wodSSHServer ActiveX Component versions 1.2.7 through 1.3.3 FreeSSHd version 1.0.9 freeFTPd version 1.0.10

Description The issue allows remote attackers to execute arbitrary code via a long key exchange algorithm string, which is a result of a stack-based buffer overflow. This can be exploited by providing a long string to the key exchange algorithm, leading to potential code execution.

Recommendations For WeOnlyDo wodSSHServer ActiveX Component versions 1.2.7 through 1.3.3, consider restricting the length of the key exchange algorithm string to prevent buffer overflow. For FreeSSHd version 1.0.9, restrict access to the key exchange algorithm to minimize the risk of exploitation. For freeFTPd version 1.0.10, avoid using long key exchange algorithm strings until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2006-2407

Affected Products

Freesshd

Weonlydo Wodsshserver Activex

Freeftpd

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ssh/freeftpd_key_exchange.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/ssh/freesshd_key_exchange.rb · Exploit
• 🔥 https://exploit-db.com/exploits/1787 · Exploit
• 🔥 https://exploit-db.com/exploits/16462 · Exploit
• 🔥 http://securityfocus.com/bid/17958 · Exploit
• 🔥 https://exploit-db.com/exploits/16461 · Exploit
• http://vupen.com/english/advisories/2006/1786 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1842 · Vendor Advisory
• http://secunia.com/advisories/19845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2407 · Security Note
• http://secunia.com/advisories/19846 · Vendor Advisory
• http://vupen.com/english/advisories/2006/1785 · Vendor Advisory
• http://secunia.com/advisories/20136 · Vendor Advisory
• http://securityfocus.com/archive/1/434007/100/0/threaded · Note
• http://securityfocus.com/archive/1/434038/100/0/threaded · Note