CWE-193
AllowedOff-by-one Error
Abstraction: Base · Status: Draft
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
261 vulnerabilities reference this CWE, most recent first.
GHSA-XMRM-F5H6-FXM7
Vulnerability from github – Published: 2022-04-29 02:57 – Updated: 2024-02-16 21:31WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly due to an off-by-one error.
{
"affected": [],
"aliases": [
"CVE-2004-0342"
],
"database_specific": {
"cwe_ids": [
"CWE-193"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2004-11-23T05:00:00Z",
"severity": "LOW"
},
"details": "WFTPD Pro Server 3.21 Release 1, with the XeroxDocutech option enabled, allows local users to cause a denial of service (crash) via a (1) MKD or (2) XMKD command that causes an absolute path of 260 characters to be used, which overwrites a cookie with a null character, possibly due to an off-by-one error.",
"id": "GHSA-xmrm-f5h6-fxm7",
"modified": "2024-02-16T21:31:29Z",
"published": "2022-04-29T02:57:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0342"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15342"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=107801142924976\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/11001"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/4116"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/9767"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().
No CAPEC attack patterns related to this CWE.