CVE-2006-6576

Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command. NOTE: it was later reported that 4.70 is also affected. NOTE: the USER vector is already covered by CVE-2005-0634.

• CWE-787

• http://packetstormsecurity.com/files/161711/Golden-FTP-Server-4.70-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• http://retrogod.altervista.org/golden_heap.htmlBroken Link
• http://secunia.com/advisories/23323Third Party Advisory
• http://www.exploit-db.com/exploits/16036Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/45924Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/45957Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/4936Third Party Advisory
• http://packetstormsecurity.com/files/161711/Golden-FTP-Server-4.70-Buffer-Overflow.htmlExploit, Third Party Advisory, VDB Entry
• http://retrogod.altervista.org/golden_heap.htmlBroken Link
• http://secunia.com/advisories/23323Third Party Advisory
• http://www.exploit-db.com/exploits/16036Exploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/45924Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/45957Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/4936Third Party Advisory

Published

Dec 15, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6570Unrestricted file upload vulnerability in upload.php in Gene…
• CVE-2006-6571Multiple cross-site scripting (XSS) vulnerabilities in form.…
• CVE-2006-6572Unspecified vulnerability in Citrix Advanced Access Control …
• CVE-2006-6573Unspecified vulnerability in Citrix Access Gateway 4.5 Advan…
• CVE-2006-6574Mantis before 1.1.0a2 does not implement per-item access con…
• CVE-2006-6575PHP remote file inclusion vulnerability in ldap.php in Brian…
• CVE-2006-6577SQL injection vulnerability in polls.php in Neocrome Land Do…
• CVE-2006-6578Microsoft Internet Information Services (IIS) 5.1 permits th…
• CVE-2006-6579Microsoft Windows XP has weak permissions (FILE_WRITE_DATA a…
• CVE-2006-6580admin/change.php in ProNews 1.5 does not check whether a use…
• CVE-2006-6581PHP remote file inclusion vulnerability in tests/debug_test.…
• CVE-2006-6582Multiple cross-site scripting (XSS) vulnerabilities in Scrip…