CVE-2006-6576: Golden FTP Server heap overflow via long PASS command

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityRemote, unauthenticated heap overflow with public exploit code and very high EPSS, though no KEV listing or confirmed in-the-wild use is documented.

What it is

Golden FTP Server (goldenftpd) 1.92, and later reported 4.70, contains a heap-based buffer overflow triggered by an overly long PASS command. A remote attacker can crash the service and possibly execute arbitrary code. The USER vector is covered separately by CVE-2005-0634.

Impact

An unauthenticated remote attacker can cause a denial of service by crashing the FTP service and may achieve arbitrary code execution on the host. Successful code execution would give the attacker the privileges of the FTP server process.

Attack surface

Reachable over the network through the FTP service by sending a crafted PASS command; the CVSS vector AV:N/AC:L/Au:N indicates no authentication or user interaction is required. The overflow occurs during password handling before any valid login is established.

Exploitation

Public exploit code exists (Exploit-DB 16036 and a Packet Storm advisory), and EPSS is 0.67223 (99.3rd percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Upgrade Golden FTP Server to a version later than 4.70 if one is available; no fixed version is stated in this record, so verify with the vendor.
• If the product is unsupported or no patch exists, retire it or replace it with a maintained FTP server.
• Restrict FTP access to trusted networks and block inbound port 21 from the internet where possible.
• Enforce strict length limits on FTP command arguments at any fronting proxy or firewall if such inspection is available.
• Run the FTP service under a low-privilege account and isolate it to limit the impact of code execution.

Detection

• Monitor FTP server logs for abnormally long PASS command arguments or repeated authentication failures followed by service restarts.
• Alert on goldenftpd process crashes or unexpected termination events on FTP hosts.
• Watch for exploit traffic matching public PoCs for Golden FTP Server 4.70 buffer overflow against port 21.
• Baseline and alert on unusual child processes or outbound connections spawned by the FTP service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.