CVE-2017-6451

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.

References

http://support.ntp.org/bin/view/Main/NtpBug3378

http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu

http://www.securityfocus.com/bid/97058

http://www.securitytracker.com/id/1038123

http://www.securitytracker.com/id/1039427

https://support.apple.com/HT208144

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us

Details

Source: MITRE

Published: 2017-03-27

Updated: 2017-10-24

Type: CWE-787

Risk Information

CVSS v2

Base Score: 4.6

Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 3.9

Severity: MEDIUM

CVSS v3

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.12:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.13:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.14:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.15:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.16:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.17:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.18:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.19:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.20:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.21:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.22:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.23:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.24:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.25:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.26:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.27:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.28:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.29:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.30:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.31:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.32:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.33:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.34:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.35:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.36:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.37:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.38:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.39:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.40:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.41:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.42:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.43:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.44:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.45:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.46:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.47:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.48:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.49:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.50:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.51:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.52:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.53:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.54:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.55:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.56:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.57:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.58:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.59:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.60:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.61:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.62:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.63:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.64:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.65:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.66:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.67:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.68:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.69:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.70:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.71:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.72:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.73:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.74:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.75:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.76:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.77:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.78:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.79:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.80:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.81:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.82:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.83:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.84:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.85:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.86:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.87:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.88:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.89:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.90:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.91:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.92:*:*:*:*:*:*:*

cpe:2.3:a:ntp:ntp:4.3.93:*:*:*:*:*:*:*

Tenable Plugins

View all (16 total)

IDNameProductFamilySeverity
700511macOS < 10.13 Multiple VulnerabilitiesNessus Network MonitorOperating System Detection
critical
121678Photon OS 1.0: Ntp PHSA-2017-0010NessusPhotonOS Local Security Checks
high
111859Photon OS 1.0: Binutils / Libarchive / Ntp PHSA-2017-0010 (deprecated)NessusPhotonOS Local Security Checks
critical
105403F5 Networks BIG-IP : NTP vulnerability (K32262483)NessusF5 Networks Local Security Checks
high
103598macOS < 10.13 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
102130AIX NTP v3 Advisory : ntp_advisory9.asc (IV96305) (IV96306) (IV96307) (IV96308) (IV96309) (IV96310)NessusAIX Local Security Checks
high
101588Fedora 26 : ntp (2017-20d54b2782)NessusFedora Local Security Checks
high
99700openSUSE Security Update : ntp (openSUSE-2017-511)NessusSuSE Local Security Checks
high
99597Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2017-112-02)NessusSlackware Local Security Checks
high
99529Amazon Linux AMI : ntp (ALAS-2017-816)NessusAmazon Linux Local Security Checks
high
99469SUSE SLES11 Security Update : ntp (SUSE-SU-2017:1052-1)NessusSuSE Local Security Checks
high
99468SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2017:1048-1)NessusSuSE Local Security Checks
high
99467SUSE SLES12 Security Update : ntp (SUSE-SU-2017:1047-1)NessusSuSE Local Security Checks
high
99445Fedora 24 : ntp (2017-72323a442f)NessusFedora Local Security Checks
high
99053Fedora 25 : ntp (2017-5ebac1c112)NessusFedora Local Security Checks
high
97988Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p10 Multiple VulnerabilitiesNessusMisc.
high