OBO

Off-By-One Off-By-One 会议的幻灯片 观看所有演讲 年份 ↓| 幻灯片| YouTube 播放列表 ---|---|--- 2024| 第一天幻灯片| 第一天 - OffByOne 2024 在线演讲 2024| 第二天幻灯片| 第二天 - OffByOne 2024 在线演讲...

cve-2010-1938

🚀 CVE-2010-1938 FTP 越界漏洞利用 一个简单的 Python 脚本，用于测试 OPIE 库中的越界漏洞（CVE-2010-1938）。该漏洞影响特定 FTP 服务器，可能导致拒绝服务（DoS）或任意代码执行。 📜 描述 该脚本针对某些 FTP 服务器使用的 OPIE 库中已知的漏洞（CVE-2010-1938）。通过发送特制的用户名，脚本试图在 FTP 服务器中引发堆栈溢出，从而导致远程代码执行。 💡 功能特性 可调节的有效载荷大小 ，用于微调利用。 以分段 方式发送有效载荷，以避免检测并防止服务器立即崩溃。 可自定义的目标 IP 和端口 ，用于渗透测试。 🚨 免责声明...

CVE-2022-3602

CVE−2022-3602 这是什么？ 本文档及仓库是 CVE−2022-3602 的分析文章，这是 OpenSSL 中的一个 punycode 缓冲区溢出问题。它是一份“反 POC”（该问题似乎不可利用），面向那些自行维护 OpenSSL 构建的人以及编译器维护者。 同一版本中还有另一个 CVE，CVE-2022-3786，它同样会导致缓冲区溢出，但在那种情况下攻击者无法控制内容。此处没有针对该问题的复现程序，但该问题可能导致崩溃，从而引发拒绝服务。 崩溃和缓冲区溢出从来都不是好事，如果你正在使用 OpenSSL 3.0.x，建议尽快更新。 欢迎通过 GitHub issue 或...

CVE-2006-3747

Files about my bugtraq publication and first working exploit for CVE-2006-3747 Apache modrewrite LDAP off-by-one buffer overflow. http://www.securityfocus.com/archive/1/443870 Public release date of POC/Exploit: 2006-08-20 Author: Jacobo Avariento Gimeno CVE id: CVE-2006-3747 Bugtraq id: 19204 CE...

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156

Baron-Samedit-Heap-Buffer-Overflow-CVE-2021-3156 易受该漏洞影响的版本 Baron Samedit 漏洞（CVE-2021-3156）影响 sudo 旧版 1.8.2 至 1.8.31p2，以及稳定版 1.9.0 至 1.9.5p1。该基于堆的缓冲区溢出缺陷于 2011 年 7 月通过提交 8255ed69 引入，并潜伏了近十年未被发现。 1.9.5p2 之前的 sudo 包含一个 off-by-one（差一）错误，可导致基于堆的缓冲区溢出，从而通过“sudoedit -s”和以单个反斜杠字符结尾的命令行参数，允许将权限提升为 root。 ...

CVE-2021-3156

CVE-2021-3156 - Sudo 中的堆缓冲区溢出 ⚠️ 仅供教育和授权安全研究使用 原始漏洞利用作者 非常感谢原始 PoC 作者 Qualys 研究团队 描述 在 Sudo 1.9.5p2 之前，存在一个差一错误，可导致基于堆的缓冲区溢出，从而通过 "sudoedit -s" 和一个以单个反斜杠字符结尾的命令行参数，实现向 root 用户的权限提升。 演示 步骤指南 1. 安装 git，然后从 GitHub 仓库克隆脚本： sudo apt install git -y git clone...

cve-2021-3156

CVE-2021-3156 -- Baron Samedit 漏洞环境 使用Dockerfille创建镜像 docker build -t cve-2021-3156:ubuntu2004 . 使用镜像创建容器 docker run --rm -it cve-2021-3156:ubuntu2004 /bin/bash 漏洞成因 在 Sudo 1.9.5p2 之前版本 中，存在一个 off-by-one 错误，可能导致 基于堆的缓冲区溢出 。 攻击者可以通过执行： sudoedit -s 在无需密码的情况下将权限提升至 root。...

CVE-2021-3156

CVE-2021-3156 1.9.5p2 之前的 Sudo 包含一个 off-by-one 错误，可能导致堆缓冲区溢出，从而允许通过 sudoedit -s 和以单个反斜杠字符结尾的命令行参数将权限提升至 root。 致谢：安全公告由 Qualys 的 Baron Samedit 提供 如何检查你是否受影响。 sudo 项目 发布了一条命令，可用于测试你的 sudo 版本是否存在漏洞： sudoedit -s '' perl -e 'print "A" x 65536' 如果你收到用法或错误消息，则说明 sudo 不存在漏洞。如果结果是段错误（Segmentation...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

CVE-2023-40296

CVE-2023-40296 async-sockets-cpp（至 0.3.1 版）在 udpsocket.hpp 中的 static void ReceiveFromUDPSocket udpSocket 函数内（约第 160-167 行）包含一个 off-by-one 缓冲区溢出漏洞。该缓冲区溢出影响所有相应的 UDP 服务器。远程攻击者可通过连接到 UDP 套接字并发送一个大型字节缓冲区来触发此远程缓冲区溢出。...

cve-2016-6187-poc

针对 https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit 的 PoC...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CentOS Linux 8.4 [TuxCare] Security Update: glib2 / glib2-devel / glib2-doc / glib2-fam / glib2-static / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1783417293)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1783417293 advisory. - A flaw was found in GLib. An off-by-one error can occur in the gvstupleisnormal function in the glib/gvariant-serialiser.c file wh...

Rocky Linux 9 [CIQ] Security Update: gimp / gimp-debuginfo / gimp-debugsource / gimp-libs / etc Multiple Vulnerabilities (crlsa-2025_7417)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257417 advisory. gimp: dds buffer overflow RCE CVE-2023-44441 gimp: PSD buffer overflow RCE CVE-2023-44442 gimp: psp integer overflow RCE CVE-2023-44443 gimp: psp off-by-on...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_9302)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259302 advisory. kernel: ice: Fix deinitializing VF in error path CVE-2025-21883 kernel: sched/fair: Fix potential memory corruption in childcfsrqonlist CVE-2025-21919...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_9348)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20259348 advisory. kernel: proc: fix UAF in procgetinode CVE-2025-21999 kernel: ext4: fix off-by-one error in dosplit CVE-2025-23150 kernel: ext4: ignore xattrs past end...

Rocky Linux 9 [CIQ] Security Update: libvirt / libvirt-client / libvirt-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2560)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242560 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition,...

Rocky Linux 8 [CIQ] Security Update: nginx / nginx-all-modules / nginx-debuginfo / nginx-debugsource / etc (crlsa-2022_0323)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20220323 advisory. nginx: Off-by-one in ngxresolvercopy when labels are followed by a pointer to a root domain name CVE-2021-23017 Tenable has extracted the preceding description bloc...

Rocky Linux 8 [CIQ] Security Update: gimp / gimp-debuginfo / gimp-debugsource / gimp-devel / etc Multiple Vulnerabilities (crlsa-2024_0861)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20240861 advisory. gimp: PSD buffer overflow RCE CVE-2023-44442 gimp: psp off-by-one RCE CVE-2023-44444 Tenable has extracted the preceding description block directly from th...