CVE-2000-0325 : Detail

CVE-2000-0325

4.58%V4
Local
2000-05-18
02h00 +00:00
2018-10-12
17h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 19435

Publication date : 1999-07-28 22h00 +00:00
Author : BrootForce
EDB Verified : Yes

# source: https://www.securityfocus.com/bid/548/info # # A vulnerability affects Microsoft's Jet 3.51 and 4.0 driver (MSJET35.DLL and MSJET40.DLL). # # This vulnerability could allow an attacker to create malicious '.xls' or '.doc' files incorporating VBA shell commands. When the file is opened, the shell commands contained in the file will execute on the target system. Command execution will occur in the context of the user that is opening the file. # # The file could be distributed via email, the web (including in hidden frames), or any number of methods. # <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Author" CONTENT="yeahright"> <META NAME="GENERATOR" CONTENT="edit.com"> <TITLE>exshell jexploit</TITLE> </HEAD> <BODY TEXT="#330033" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000"> <FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This is a benign demonstration of the Jet 3.51 vulnerability documented by J.C.G. Cuartango.</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This vulnerability affects users of Office95/97 with Jet database engine versions around 3.5 (tested 3.51.1029.00)</FONT></FONT></FONT> <P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>On the bottom of this page is an invisible, embedded .xls file that will do a few things if you double-click it:</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>1.&nbsp; Get a welcome note from ftp.aol.com and write it to your hd as c:\ftptest.txt</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>2.&nbsp; Write a log file of the ftp session to your hd as c:\jexploit.log</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>3.&nbsp; Open regedit.exe on your computer.</FONT></FONT></FONT> <P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>There are no macros, so there are no macro warnings.&nbsp; There are currently (8/3/99) no AV products to stop this.</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This could be changed slightly to format your hd without prompts or perform several other devastating functions.</FONT></FONT></FONT> <P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>The purpose of this demonstration is as follows:</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>1.&nbsp; To have some innocent fun.</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>2.&nbsp; To demonstrate how to have fun.</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>3.&nbsp; To show the vulnerabilities in yet another M$ product.</FONT></FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>4.&nbsp; To alert the AV people that they need to work on this problem.</FONT></FONT></FONT> <P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>If you use IE or see a broken link next to the arrow just click <A HREF="shell.xls"> here.</A> &nbsp;&nbsp;Probably your browser can't view embedded xls.</FONT></FONT> <BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1> The malicious potential of this exploit is great.</FONT></FONT></FONT> <P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1> Have a nice day!!!&nbsp;&nbsp;&nbsp;-ßrootFôrce</FONT></FONT></FONT> <p>&nbsp;<p> <BODY TEXT="#330033" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000"> <FONT COLOR="#993366"><FONT FACE="Felix Titling"><FONT SIZE=+1>this is a test of the emergency broadcast system.</FONT></FONT></FONT> <P><FONT FACE="Felix Titling"><FONT COLOR="#993366"><FONT SIZE=+1>click this here thingy to test==></FONT></FONT></FONT>&nbsp; <EMBED src="shell.xls" width=50 height=50></EMBED> </BODY> </HTML> <IMG SRC="http://geo.yahoo.com/serv?s=76000007&t=933696590" WIDTH=1 HEIGHT=1> <!-- <SERVICE NAME="toto"> --> <SCRIPT LANGUAGE="javascript"> <!-- window.open('/toto?s=76000007', '_geo_toto', 'width=515,height=125'); // --> </SCRIPT> <!-- </SERVICE> -->

Products Mentioned

Configuraton 0

Microsoft>>Jet >> Version 3.5

Microsoft>>Jet >> Version 3.5.1

References

http://www.securityfocus.com/bid/548
Tags : vdb-entry, x_refsource_BID
The information presented on CVE Find originates from several carefully selected reference sources. CVE data is provided by MITRE Corporation and the National Vulnerability Database (NVD). The Known Exploited Vulnerabilities (KEV) catalog is sourced from the Cybersecurity and Infrastructure Security Agency (CISA), while EPSS scores come from FIRST.org. Additionally, data regarding software weaknesses (CWE) and common attack patterns (CAPEC) is maintained by MITRE Corporation, and information on hardware and software configurations (CPE) is provided by the NVD.