CVE-2006-2407

HIGH 7.5CVE-2006-2407 · Published 16/05/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
freeftpd freeftpd	`= 1.0.10`	No fix yet
freesshd freesshd	`= 1.0.9`	No fix yet
wodsshserver weonlydo	`= 1.2.7= 1.3.3_demo`	No fix yet

Description

Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string.

References

marc.info
secunia.com/advisories/19845 · Patch
secunia.com/advisories/19846 · Vendor Advisory
secunia.com/advisories/20136 · Vendor Advisory
securityreason.com/securityalert/901
kb.cert.org/vuls/id/477960 · US Government Resource
osvdb.org/25463
osvdb.org/25569
securityfocus.com/archive/1/434007/100/0/threaded
securityfocus.com/archive/1/434038/100/0/threaded
securityfocus.com/archive/1/434402/100/0/threaded
securityfocus.com/archive/1/434415/100/0/threaded
securityfocus.com/archive/1/434415/30/4920/threaded
securityfocus.com/bid/17958 · Exploit
vupen.com/english/advisories/2006/1785 · Vendor Advisory
vupen.com/english/advisories/2006/1786 · Vendor Advisory
vupen.com/english/advisories/2006/1842 · Vendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/26442

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free