High severity · published Mar 27, 2017
CVE-2017-6458
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable
8.8
CVSS
6.5%
EPSS
No
On KEV
Description
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.5% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HP
Hpux-ntp · Hpe
before c.4.2.8.4.0 · source: NVD
MO
Mac OS X · Apple
10.8.0 before 10.13 · source: NVD
NT
Ntp · Ntp
before 4.2.8; 4.3.0 before 4.3.94; 4.2.8; 4.2.8; 4.2.8; 4.2.8; +19 more · source: NVD
SN
Simatic Net CP 443-1 Opc UA Firmware · Siemens
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6458
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6458
packetstormsecurity.com
http://packetstormsecurity.com/files/142284/Slackware-Security-Advisory-ntp-Updates.html
seclists.org
http://seclists.org/fulldisclosure/2017/Nov/7
seclists.org
http://seclists.org/fulldisclosure/2017/Sep/62
Patch
http://support.ntp.org/bin/view/Main/NtpBug3379
Vendor Advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu
www.securityfocus.com
http://www.securityfocus.com/archive/1/archive/1/540464/100/0/threaded
More from Mac OS X
9.8
CVE-2021-1871
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
9.8
CVE-2021-1870
Apple iOS, iPadOS, and macOS WebKit Remote Code Execution Vulnerability
9.8
CVE-2012-1823
PHP-CGI Query String Parameter Vulnerability
8.8
CVE-2022-2294
WebRTC Heap Buffer Overflow Vulnerability
8.8
CVE-2021-1789
Apple Multiple Products Type Confusion Vulnerability