CVE-2017-6451
high-risk
Published 2017-03-27
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
Do I need to act?
-
0.16% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10
High
LOCAL
/ LOW complexity
Affected Products (20)
Affected Vendors
References (14)
Third Party Advisory
http://www.securityfocus.com/bid/97058
Third Party Advisory
http://www.securitytracker.com/id/1038123
Third Party Advisory
http://www.securityfocus.com/bid/97058
Third Party Advisory
http://www.securitytracker.com/id/1038123
55
/ 100
high-risk
Severity
24/34 · High
Exploitability
1/34 · Minimal
Exposure
30/34 · Critical