CVE-2006-6767

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-01-16 · updated 2026-06-16
Weakness: CWE-617

Description

oftpd before 0.3.7 allows remote attackers to cause a denial of service (daemon abort) via a (1) LPRT or (2) LPASV command with an unsupported address family, which triggers an assertion failure.

Affected products

Time-Travellers Oftpd: before 0.3.7 — fixed in 0.3.7

How to fix

Upgrade to a fixed version: Time-Travellers Oftpd 0.3.7. Check the vendor advisory for mitigations.

References

http://osvdb.org/32822
http://secunia.com/advisories/23790
http://secunia.com/advisories/23797
http://securitytracker.com/id?1017517
http://www.gentoo.org/security/en/glsa/glsa-200701-09.xml
http://www.securityfocus.com/bid/22073
http://www.vupen.com/english/advisories/2007/0198
https://exchange.xforce.ibmcloud.com/vulnerabilities/31520
http://osvdb.org/32822
http://secunia.com/advisories/23790
http://secunia.com/advisories/23797
http://securitytracker.com/id?1017517

Get alerted when CVE-2006-6767 or the next vulnerability affects your stack