Host DDoS Attack Master Infection privileges management

Summaryinfo

A vulnerability labeled as very critical has been found in Host. This impacts an unknown function of the component DDoS Attack Master Infection. Executing a manipulation can lead to privileges management. This vulnerability appears as CVE-2000-0138. In addition, an exploit is available. This vulnerability is historically impactful due to its background and the reception it garnered. Configuration settings should be changed.

Detailsinfo

A vulnerability classified as critical was found in Host (the affected version unknown). This vulnerability affects an unknown part of the component DDoS Attack Master Infection. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect availability. CVE summarizes:

A system has a distributed denial of service (DDOS) attack master, agent, or zombie installed, such as (1) Trinoo, (2) Tribe Flood Network (TFN), (3) Tribe Flood Network 2000 (TFN2K), (4) stacheldraht, (5) mstream, or (6) shaft.

The weakness was presented 05/02/2000 as not defined advisory (X-Force). The advisory is shared for download at xforce.iss.net. This vulnerability was named CVE-2000-0138. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are unknown but a public exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/21/2026). The MITRE ATT&CK project declares the attack technique as T1068. This vulnerability has a historic impact due to its background and reception.

It is declared as highly functional. As 0-day the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 10350 (Shaft Trojan Detection), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Backdoors, running in the context r and relying on port 1024. The Nessus plugin is testing the existence of the vulnerability with the following NASL code:

function detect(dport, sport)
{
local_var command, dstport, filter, ip, len, r, udp;

command = string("ping\n");
ip  = forge_ip_packet(ip_hl:5, ip_v:4,   ip_off:0,
		      ip_id:9, ip_tos:0, ip_p : IPPROTO_UDP,
		      ip_len : 20, ip_src : this_host(),
		     ip_ttl : 255);

len = 8 + strlen(command);
udp = forge_udp_packet( ip:ip,
			uh_sport:65535,
			uh_dport:dport,
			uh_ulen : len,
			data:command);

filter = string("udp and src host ", get_host_ip(), " and dst port ", sport, " and dst host ", this_host());

r = send_packet(udp, pcap_active:TRUE, pcap_filter:filter, pcap_timeout:3);
if(!isnull(r))	{
	dstport = get_udp_element(udp:r, element:"uh_dport");
	if(dstport == sport)return(1);
	else return(0);
    }
else return(0);
}

It is possible to mitigate the problem by applying the configuration setting . Attack attempts may be identified with Snort ID 221. Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 1576.

The vulnerability is also documented in the databases at X-Force (2245), Tenable (10350) and Vulnerability Center (SBV-4541†). Additional details are provided at marc.theaimsgroup.com. Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• Host

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion