{"id":"CVE-2017-6451","aliases":["EUVD-2017-15508","GHSA-mg4x-c4g8-f6h5","MGASA-2017-0134","SUSE-SU-2017:1047-1","SUSE-SU-2017:1048-1","SUSE-SU-2017:1052-1","openSUSE-SU-2024:11102-1"],"status":"published","title":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4...","description":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00481,"percentile":0.41768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2017-03-27T17:00:00Z","modified":"2026-06-17T01:22:22Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.6p5-24.8.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-46.23.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-46.23.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-60.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-63.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p10-63.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p15-7.2"}]}],"bundled":18}],"products":[{"vendor":"ntp","product":"ntp"}],"references":[{"url":"http://support.ntp.org/bin/view/Main/NtpBug3378","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1038123","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/97058","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://support.apple.com/HT208144","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securitytracker.com/id/1039427","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6451"},{"url":"https://github.com/advisories/GHSA-mg4x-c4g8-f6h5"},{"url":"https://advisories.mageia.org/MGASA-2017-0134.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20595","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4B7BMVXV53EE7XYW2KAVETDHTP452O3Z/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171047-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1014172","tags":["report"]},{"url":"https://bugzilla.suse.com/1030050","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6464","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171052-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1031085","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-8956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15025","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-6451","description":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-05T15:33:20.432Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2017-15508","description":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.","status":"published","published":"2017-03-27T17:00:00Z","modified":"2024-08-05T15:33:20Z","updated_at":"2026-11-03T02:39:12.023695Z"}],"ghsa":[{"id":"GHSA-mg4x-c4g8-f6h5","title":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4...","description":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.","status":"published","published":"2022-05-17T00:31:37Z","modified":"2023-02-03T05:01:51Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:53:03.296613Z"}],"nvd":[{"id":"CVE-2017-6451","description":"The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.","status":"published","published":"2017-03-27T17:59:00.523Z","modified":"2026-06-17T01:22:22.07Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"MGASA-2017-0134","title":"Updated ntp packages fix security vulnerability","description":"A vulnerability was found in NTP, in the legacy MX4200 refclock\nimplementation. If this refclock was compiled in and used, an attacker may\nbe able to induce stack overflow, leading to a crash or potential code\nexecution (CVE-2017-6451).\n\nA vulnerability was found in NTP, in the building of response packets with\ncustom fields. If custom fields were configured in ntp.conf with\nparticularly long names, inclusion of these fields in the response packet\ncould cause a buffer overflow, leading to a crash (CVE-2017-6458).\n\nA vulnerability was found in NTP, in the parsing of packets from the\n/dev/datum device. A malicious device could send crafted messages, causing\nntpd to crash (CVE-2017-6462).\n\nA vulnerability was discovered in the NTP server's parsing of\nconfiguration directives. A remote, authenticated attacker could cause\nntpd to crash by sending a crafted message (CVE-2017-6463).\n\nA vulnerability was discovered in the NTP server's parsing of\nconfiguration directives. A remote, authenticated attacker could cause\nntpd to crash by sending a crafted message (CVE-2017-6464).\n","status":"published","published":"2017-05-09T06:35:29Z","modified":"2026-04-16T06:23:21.597234861Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11102-1","title":"ntp-4.2.8p15-7.2 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:08:15.257534Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2017:1047-1","title":"Security update for ntp","description":"\nThis ntp update to version 4.2.8p10 fixes serveral issues.\n\nThis updated enables leap smearing. See\n/usr/share/doc/packages/ntp/README.leapsmear for details.\n\nSecurity issues fixed (bsc#1030050):\n\n- CVE-2017-6464: Denial of Service via Malformed Config\n- CVE-2017-6462: Buffer Overflow in DPTS Clock\n- CVE-2017-6463: Authenticated DoS via Malicious Config Option\n- CVE-2017-6458: Potential Overflows in ctl_put() functions\n- CVE-2017-6451: Improper use of snprintf() in mx4200_send()\n- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist\n- CVE-2016-9042: 0rigin (zero origin) DoS.\n- ntpq_stripquotes() returns incorrect Value\n- ereallocarray()/eallocarray() underused\n- Copious amounts of Unused Code\n- Off-by-one in Oncore GPS Receiver\n- Makefile does not enforce Security Flags\n\nBugfixes:\n\n- Remove spurious log messages (bsc#1014172).\n- clang scan-build findings\n- Support for openssl-1.1.0 without compatibility modes\n- Bugfix 3072 breaks multicastclient\n- forking async worker: interrupted pipe I/O\n- (...) time_pps_create: Exec format error\n- Incorrect Logic for Peer Event Limiting\n- Change the process name of forked DNS worker\n- Trap Configuration Fail\n- Nothing happens if minsane \u003c maxclock \u003c minclock\n- allow -4/-6 on restrict line with mask\n- out-of-bound pointers in ctl_putsys and decode_bitflags\n- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for\n  transactional updates.\n","status":"published","published":"2017-04-18T14:06:17Z","modified":"2026-02-04T02:21:45.857408Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1048-1","title":"Security update for ntp","description":"\nThis ntp update to version 4.2.8p10 fixes serveral issues.\n\nThis updated enables leap smearing. See\n/usr/share/doc/packages/ntp/README.leapsmear for details.\n\nSecurity issues fixed (bsc#1030050):\n\n- CVE-2017-6464: Denial of Service via Malformed Config\n- CVE-2017-6462: Buffer Overflow in DPTS Clock\n- CVE-2017-6463: Authenticated DoS via Malicious Config Option\n- CVE-2017-6458: Potential Overflows in ctl_put() functions\n- CVE-2017-6451: Improper use of snprintf() in mx4200_send()\n- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist\n- CVE-2016-9042: 0rigin (zero origin) DoS.\n- ntpq_stripquotes() returns incorrect Value\n- ereallocarray()/eallocarray() underused\n- Copious amounts of Unused Code\n- Off-by-one in Oncore GPS Receiver\n- Makefile does not enforce Security Flags\n\nBugfixes:\n\n- Remove spurious log messages (bsc#1014172).\n- clang scan-build findings\n- Support for openssl-1.1.0 without compatibility modes\n- Bugfix 3072 breaks multicastclient\n- forking async worker: interrupted pipe I/O\n- (...) time_pps_create: Exec format error\n- Incorrect Logic for Peer Event Limiting\n- Change the process name of forked DNS worker\n- Trap Configuration Fail\n- Nothing happens if minsane \u003c maxclock \u003c minclock\n- allow -4/-6 on restrict line with mask\n- out-of-bound pointers in ctl_putsys and decode_bitflags\n- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for\n  transactional updates.\n","status":"published","published":"2017-04-18T14:06:01Z","modified":"2026-02-04T03:40:36.128491Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1052-1","title":"Security update for ntp","description":"\nThis ntp update to version 4.2.8p10 fixes the following issues:\n\nSecurity issues fixed (bsc#1030050):\n- CVE-2017-6464: Denial of Service via Malformed Config\n- CVE-2017-6462: Buffer Overflow in DPTS Clock\n- CVE-2017-6463: Authenticated DoS via Malicious Config Option\n- CVE-2017-6458: Potential Overflows in ctl_put() functions\n- CVE-2017-6451: Improper use of snprintf() in mx4200_send()\n- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist\n- CVE-2016-9042: 0rigin (zero origin) DoS.\n- ntpq_stripquotes() returns incorrect Value\n- ereallocarray()/eallocarray() underused\n- Copious amounts of Unused Code\n- Off-by-one in Oncore GPS Receiver\n- Makefile does not enforce Security Flags\n\nBugfixes:\n- Remove spurious log messages (bsc#1014172).\n- Fixing ppc and ppc64 linker issue (bsc#1031085).\n- clang scan-build findings\n- Support for openssl-1.1.0 without compatibility modes\n- Bugfix 3072 breaks multicastclient\n- forking async worker: interrupted pipe I/O\n- (...) time_pps_create: Exec format error\n- Incorrect Logic for Peer Event Limiting\n- Change the process name of forked DNS worker\n- Trap Configuration Fail\n- Nothing happens if minsane \u003c maxclock \u003c minclock\n- allow -4/-6 on restrict line with mask\n- out-of-bound pointers in ctl_putsys and decode_bitflags\n- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for\n  transactional updates.\n","status":"published","published":"2017-04-18T14:06:55Z","modified":"2026-02-04T03:30:54.871081Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}