Code Injection in ntp - CVE-2017-6455

Vulnerability identifier: #VU39359

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-6455

CWE-ID: CWE-94

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local authenticated user to execute arbitrary code.

NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.

ntp
Junos OS
Slackware Linux
Junos OS Evolved

Install update from vendor's website.

Junos OS - addressed in versions 12.3X48-D95, 12.3R12-S15, 14.1X53-D53, 15.1x49-D190, 15.1R7-S6, 16.1R7-S6, 16.2R3, 17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.3R2-S5, 17.3R3-S6, 17.4R2-S7, 17.4R3, 18.1R3-S8, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S2, 18.3R3, 18.4R1-S4, 18.4R2-S1, 18.4R3, 19.1R1-S3, 19.1R2, 19.2R1-S1, 19.2R2, 19.3R1
Junos OS Evolved - update to 20.1R1-EVO

• http://support.ntp.org/bin/view/Main/NtpBug3384
• http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu
• http://www.securityfocus.com/bid/97074
• http://www.securitytracker.com/id/1038123
• http://www.securitytracker.com/id/1039427
• https://support.apple.com/HT208144

• Multiple vulnerabilities in ntp
• Slackware Linux update for ntp
• Multiple NTP vulnerabilities in Junos OS and Junos OS Evolved