CVE-2017-6455
HighSummary
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
Risk Assessment
This vulnerability may lead to privilege escalation by local users, posing a threat to system integrity.
Recommendation
It is recommended to update NTP to the latest version to mitigate the risk associated with this vulnerability.
Other vulnerabilities in NTP
See all- CVE-2015-5300High
The panic_gate check in NTP before version 4.2.8p5 is only re-enabled after the first change to the system clock greater than 128 milliseconds. This allows remote attackers to set NTP to an arbitrary time when started with the -g option or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources.
- CVE-2016-7434High
The read_mru_list function in NTP before version 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
- CVE-2015-7974High
NTP versions 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, known as a 'skeleton key.'
Original NVD description (English source)
NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.