Stack-based buffer overflow in ntp - CVE-2017-6452
Published: March 27, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU39358
CSH Severity: Medium
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-6452
CWE-ID: CWE-121
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing an application path on the command line. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
ntp
Junos OS
Slackware Linux
Junos OS Evolved
Junos OS
Slackware Linux
Junos OS Evolved
How to mitigate CVE-2017-6452
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Junos OS - addressed in versions 12.3X48-D95, 12.3R12-S15, 14.1X53-D53, 15.1x49-D190, 15.1R7-S6, 16.1R7-S6, 16.2R3, 17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.3R2-S5, 17.3R3-S6, 17.4R2-S7, 17.4R3, 18.1R3-S8, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S2, 18.3R3, 18.4R1-S4, 18.4R2-S1, 18.4R3, 19.1R1-S3, 19.1R2, 19.2R1-S1, 19.2R2, 19.3R1
Junos OS Evolved - update to 20.1R1-EVO
Junos OS Evolved - update to 20.1R1-EVO