Vulnerability Details : CVE-2006-6684
Heap-based buffer overflow in Pedro Lineu Orso chetcpasswd before 2.4 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long X-Forwarded-For HTTP header. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Vulnerability category: OverflowExecute codeDenial of service
Products affected by CVE-2006-6684
- cpe:2.3:a:pedro_lineu_orso:chetcpasswd:*:*:*:*:*:*:*:*
- cpe:2.3:a:pedro_lineu_orso:chetcpasswd:2.3.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2006-6684
1.73%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 81 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-6684
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2006-6684
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2006-6684
-
http://secunia.com/advisories/22967
About Secunia Research | FlexeraVendor Advisory
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=394454
#394454 - uses HTTP_X_FORWARDED_FOR for authentication (and other security holes) - Debian Bug report logsVendor Advisory
-
http://www.osvdb.org/30546
Vendor Advisory
Jump to