CVE-2017-6458
High
Description
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
SeverityHigh
CVSS8.8
Exploit probability—
Product
Ntp
PublishedMar 27, 2017
First seenMar 27, 2017
How to fix
Update
- ntp ntp4.2.8, 4.3.94 or later
- hpe hpux-ntpc.4.2.8.4.0 or later
- apple mac_os_x10.13 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZUPPICJXWL3AWQB7I3AWUC74YON7UING/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7KVLFA3J43QFIP4I7HE7KQ5FXSMJEKC6/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4B7BMVXV53EE7XYW2KAVETDHTP452O3Z/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ntp ntp | v < 4.2.8, 4.3.0 ≤ v < 4.3.94, 4.2.8 | 4.2.8, 4.3.94 |
| hpe hpux-ntp | v < c.4.2.8.4.0 | c.4.2.8.4.0 |
| apple mac_os_x | 10.8.0 ≤ v < 10.13 | 10.13 |
| siemens simatic_net_cp_443-1_opc_ua_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.