CVE-2025-5548

FreeFloat FTP 분석 및 CVE-2025-5548 악용 Anderson Steven — 사이버보안 석사, 모듈 6취약점 개인 과제: 취약점 분석 및 악용 방법론 이 저장소를 만든 이유 저는 단순히 "작동하는 익스플로잇을 여기 있다"고 제출하고 싶지 않았습니다. 이 저장소는 메모리 손상 취약점에 직면했을 때 제가 실제로 작업하는 방식을 담고 있습니다: 무엇을 먼저 살피는지, 어떤 순서로 가설을 배제하는지, 각 단계에서 어떤 도구를 사용하는지, 그리고 그 이유가 무엇인지. CVE-2025-5548을 중심 축으로 사용한 이...

CentOS Linux 8 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS-STREAM8:CLSA-2026:1777977059)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1777977059 advisory. - Sending NOOP ... command with 4000 parenthesis open+close results in 1MB extra memory usage. Longer commands will result in client...

CentOS Linux 6 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS6:CLSA-2026:1778250399)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778250399 advisory. - Sending NOOP ... command with 4000 parenthesis open+close results in 1MB extra memory usage. Longer commands will result in client disconnectio...

Rocky Linux 9 [CIQ] Security Update: dovecot / dovecot-debuginfo / dovecot-debugsource / dovecot-devel / etc Multiple Vulnerabilities (crlsa-2026_19364)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619364 advisory. dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command CVE-2025-59032 dovecot: denial of service via crafted...

CentOS Linux 8.5 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS8.5:CLSA-2026:1777978787)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1777978787 advisory. - Sending NOOP ... command with 4000 parenthesis open+close results in 1MB extra memory usage. Longer commands will result in client...

AlmaLinux 9.2 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (ALMALINUX9.2:CLSA-2026:1778022490)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778022490 advisory. - Sending NOOP ... command with 4000 parenthesis open+close results in 1MB extra memory usage. Longer commands will result in client...

CentOS Linux 8.4 [TuxCare] Security Update: dovecot / dovecot-devel / dovecot-mysql / dovecot-pgsql / etc (CENTOS8.4:CLSA-2026:1777976700)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1777976700 advisory. - Sending NOOP ... command with 4000 parenthesis open+close results in 1MB extra memory usage. Longer commands will result in client...

CVE-2025-5548

CVE-2025-5548 CVE-2025-5548 のセキュリティ調査と技術分析。FreeFloat FTP Server 1.0 に影響するバッファオーバーフローの脆弱性です。 このリポジトリは、安全なラボ環境内での脆弱性の挙動、攻撃対象領域の分析、管理された概念実証テスト、および防御的な観察結果を文書化しています。 概要 CVE-2025-5548 は、NOOP コマンドを通じてトリガーされる FreeFloat FTP Server 1.0 のバッファオーバーフロー脆弱性です。 ユーザーが提供する入力に対する境界チェックが不適切なため、攻撃者は過大なペイロードを送信し、FTP...

CVE-2025-5548

🚀 CVE-2025-5548 - FreeFloat FTP Server 1.0 익스플로잇 전문적인 취약점 분석 및 완전한 원격 버퍼 오버플로우 익스플로잇 🎯 프로젝트 하이라이트 완전한 실제 사례 연구 : CVE-2025-5548 NOOP 명령을 통한 FreeFloat FTP Server 1.0의 원격 스택 기반 버퍼 오버플로우 수동 도구 설치 + 자동화 스크립트 Windows & Linux Windows 11 VM에서의 완전히 문서화된 실습 환경 단계별 익스플로잇 : 퍼징 → 오프셋 → 배드 캐릭터 → JMP ESP → 작동하는...

CVE-2025-5548-POC

CVE-2025-5548-POC 취약점 설명 CVE-2025-5548 은 FreeFloat FTP ServerWindows 시스템용 레거시 FTP 서비스에서 식별된 스택 버퍼 오버플로우 취약점입니다. 결함은 NOOP 명령어 핸들러에 있으며, 입력의 크기를 검증하지 않고 스택의 고정 크기 버퍼에 복사합니다. 이를 통해 인증되지 않은 원격 공격자가 과도한 크기의 문자열을 전송하여 EIP 레지스터를 덮어쓰고 실행 흐름을 임의 코드로 리디렉션할 수 있습니다. 유형: 스택 버퍼 오버플로우 CWE-121 벡터: 네트워크 인증 없는 원격 ...

CVE-2025-5548

취약점 분석 및 익스플로잇 문서 목적: 실습 환경 구축 중 습득한 지식을 정리하고, CVE-2025-5548 익스플로잇 과정을 상세히 기술하며, 알려지지 않은 취약점0-day 연구를 위한 다음 단계를 제시합니다. 1. 취약점 탐색에 대한 나의 시각 이 모듈을 통해 익스플로잇을 개발하는 것은 정밀한 수술 작업임을 깨달았습니다. 자동 스캐너를 무작정 돌리는 것이 아니라, 컴퓨터가 내부적으로 정보를 어떻게 처리하는지 이해하는 것이 중요합니다. 실제 작업 사이클은 세 가지 기둥에 기반한다는 것을 배웠습니다: 관찰Ghidra와 같은...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Freefloat Freefloat_Ftp_Server

CVE-2025-5548 — FreeFloat FTP Server 1.0 Laboratorio académic...

Astra Linux – Vulnerability in dovecot

Sending the “NOOP ...” command with 4000 opening and closing parentheses results in an additional 1MB of memory usage. Longer commands will cause the client to disconnect. This 1MB of memory can be reserved for longer periods of time by not sending the command that ends with LF. Thus, an attacker...

CVE-2026-85513

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

EUVD-2026-71087

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513

StackStorm st2 up to 3.9.0 is vulnerable to improper privilege management in the NoOp RBAC backend . The flaw resides in the function assert_user_is_admin_if_user_query_param_is_provided within st2api/controllers/v1/actionexecutions.py, where manipulation of the User query parameter allows a remo...

CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-85513: Improper Privilege Management

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

PT-2026-85521

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert user is admin if user query param is provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes imprope...