5.5med
CVE-2017-6459
The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 35%
Public exploits
0
none known
Summary
The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
Exploit prediction (EPSS)
0.41% probability of exploitation in the next 30 days, higher than 35% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:N/I:N/A:P |
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securitytracker.com /id/1038123 · vdb-entry, x_refsource_SECTRACK, x_transferred
- support.apple.com /HT208144 · x_refsource_CONFIRM, x_transferred
- support.ntp.org /bin/view/Main/NtpBug3382 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/97076 · vdb-entry, x_refsource_BID, x_transferred
- support.ntp.org /bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-6459
- NVD: CVE-2017-6459
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.