CVE-2006-2407

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 71%

from disclosure to weapon0 days

Published on NVDMay 16

1st PoCMay 15

metasploitMay 12

exploitation probability

71%top 1% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

Stack-based buffer overflow in (1) WeOnlyDo wodSSHServer ActiveX Component 1.2.7 and 1.3.3 DEMO, as used in other products including (2) FreeSSHd 1.0.9 and (3) freeFTPd 1.0.10, allows remote attackers to execute arbitrary code via a long key exchange algorithm string.

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/16462unverified exploitdbwww.exploit-db.com/exploits/1787unverified exploitdbwww.exploit-db.com/exploits/16461unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://marc.info/?l=full-disclosure&m=114764338702488&w=2 http://secunia.com/advisories/19845 http://secunia.com/advisories/19846 http://secunia.com/advisories/20136 http://securityreason.com/securityalert/901 https://exchange.xforce.ibmcloud.com/vulnerabilities/26442 http://www.kb.cert.org/vuls/id/477960 http://www.osvdb.org/25463 http://www.osvdb.org/25569 http://www.securityfocus.com/archive/1/434007/100/0/threaded http://www.securityfocus.com/archive/1/434038/100/0/threaded http://www.securityfocus.com/archive/1/434402/100/0/threaded