Sign-up

ID

VAR-201708-1312


CVE

CVE-2017-6327


TITLE

Symantec Messaging Gateway Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2017-007188

DESCRIPTION

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges. Symantec Messaging Gateway Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Symantec Messaging Gateway is prone to a remote code-execution vulnerability. Attackers can exploit this issue to execute arbitrary code on the affected system. Versions prior to Symantec Messaging Gateway 10.6.3-267 are vulnerable. Symantec Messaging Gateway is a set of anti-spam, anti-virus, advanced content filtering and data leakage prevention technologies developed by Symantec

Trust: 2.07

sources: NVD: CVE-2017-6327 // JVNDB: JVNDB-2017-007188 // BID: 100135 // VULHUB: VHN-114530 // VULMON: CVE-2017-6327

AFFECTED PRODUCTS

vendor:symantecmodel:message gatewayscope:ltversion:10.6.3-267

Trust: 1.8

vendor:symantecmodel:message gatewayscope:eqversion:10.6.3-2

Trust: 0.6

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.3

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.5.2

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.5.1

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.5

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.0.1

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:9.5.4

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:9.5.3

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:9.5.3-3

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:9.5.2

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:9.5.1

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:9.5

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.3-266

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.2

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.1-3

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.1

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.0-7

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6.0-3

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.6

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.1

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.0.3

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.0.2

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:eqversion:10.0

Trust: 0.3

vendor:symantecmodel:messaging gatewayscope:neversion:10.6.3-267

Trust: 0.3

sources: BID: 100135 // JVNDB: JVNDB-2017-007188 // CNNVD: CNNVD-201702-869 // NVD: CVE-2017-6327

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6327
value: HIGH

Trust: 1.0

NVD: CVE-2017-6327
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201702-869
value: HIGH

Trust: 0.6

VULHUB: VHN-114530
value: MEDIUM

Trust: 0.1

VULMON: CVE-2017-6327
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2017-6327
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-114530
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6327
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2017-6327
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-114530 // VULMON: CVE-2017-6327 // JVNDB: JVNDB-2017-007188 // CNNVD: CNNVD-201702-869 // NVD: CVE-2017-6327

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-264

Trust: 0.9

problemtype:CWE-20

Trust: 0.1

sources: VULHUB: VHN-114530 // JVNDB: JVNDB-2017-007188 // NVD: CVE-2017-6327

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201702-869

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201702-869

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-007188

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-114530 // 
            
            
            
            VULMON: CVE-2017-6327

PATCH
title:SYM17-006url:https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
Trust: 0.8
title:Symantec Messaging Gateway Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99656
Trust: 0.6
title:Symantec Security Advisories: Symantec Messaging Gateway RCE and CSRFurl:https://vulmon.com/vendoradvisory?qidtp=symantec_security_advisories&qid=c0ee8fdc79b5124205ebcb6279717998
Trust: 0.1
title:Awesome CVE PoCurl:https://github.com/lnick2023/nicenice 
Trust: 0.1
title:Awesome CVE PoCurl:https://github.com/xbl3/awesome-cve-poc_qazbnm456 
Trust: 0.1
title:Known Exploited Vulnerabilities Detectorurl:https://github.com/Ostorlab/KEV 
Trust: 0.1
title:Awesome CVE PoCurl:https://github.com/qazbnm456/awesome-cve-poc 
Trust: 0.1
title:Threatposturl:https://threatpost.com/bug-nsa-china-backed-cyberattacks/160421/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2017-6327 // 
            
            
            
            JVNDB: JVNDB-2017-007188 // 
            
            
            
            CNNVD: CNNVD-201702-869

EXTERNAL IDS
db:NVDid:CVE-2017-6327
Trust: 2.9
db:BIDid:100135
Trust: 2.1
db:EXPLOIT-DBid:42519
Trust: 1.8
db:JVNDBid:JVNDB-2017-007188
Trust: 0.8
db:CNNVDid:CNNVD-201702-869
Trust: 0.7
db:SEEBUGid:SSVID-96367
Trust: 0.1
db:PACKETSTORMid:143821
Trust: 0.1
db:VULHUBid:VHN-114530
Trust: 0.1
db:VULMONid:CVE-2017-6327
Trust: 0.1
sources:
            
            
            VULHUB: VHN-114530 // 
            
            
            
            VULMON: CVE-2017-6327 // 
            
            
            
            BID: 100135 // 
            
            
            
            JVNDB: JVNDB-2017-007188 // 
            
            
            
            CNNVD: CNNVD-201702-869 // 
            
            
            
            NVD: CVE-2017-6327

REFERENCES
url:https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
Trust: 2.0
url:http://www.securityfocus.com/bid/100135
Trust: 1.9
url:https://www.exploit-db.com/exploits/42519/
Trust: 1.9
url:http://seclists.org/fulldisclosure/2017/aug/28
Trust: 1.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6327
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-6327
Trust: 0.8
url:http://www.symantec.com
Trust: 0.3
url:https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/bug-nsa-china-backed-cyberattacks/160421/
Trust: 0.1
url:https://support.symantec.com/en_us/article.symsa1411.html
Trust: 0.1
sources:
            
            
            VULHUB: VHN-114530 // 
            
            
            
            VULMON: CVE-2017-6327 // 
            
            
            
            BID: 100135 // 
            
            
            
            JVNDB: JVNDB-2017-007188 // 
            
            
            
            CNNVD: CNNVD-201702-869 // 
            
            
            
            NVD: CVE-2017-6327

CREDITS
Philip Pettersson: philip.pettersson@gmail.com
Trust: 0.3
sources:
            
            
            BID: 100135

SOURCES
db:VULHUBid:VHN-114530
db:VULMONid:CVE-2017-6327
db:BIDid:100135
db:JVNDBid:JVNDB-2017-007188
db:CNNVDid:CNNVD-201702-869
db:NVDid:CVE-2017-6327

LAST UPDATE DATE
2024-08-14T15:34:35.698000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-114530date:2019-10-03T00:00:00
db:VULMONid:CVE-2017-6327date:2019-10-03T00:00:00
db:BIDid:100135date:2017-08-10T00:00:00
db:JVNDBid:JVNDB-2017-007188date:2017-09-13T00:00:00
db:CNNVDid:CNNVD-201702-869date:2019-10-23T00:00:00
db:NVDid:CVE-2017-6327date:2024-07-24T17:11:25.850

SOURCES RELEASE DATE
db:VULHUBid:VHN-114530date:2017-08-11T00:00:00
db:VULMONid:CVE-2017-6327date:2017-08-11T00:00:00
db:BIDid:100135date:2017-08-10T00:00:00
db:JVNDBid:JVNDB-2017-007188date:2017-09-13T00:00:00
db:CNNVDid:CNNVD-201702-869date:2017-02-27T00:00:00
db:NVDid:CVE-2017-6327date:2017-08-11T20:29:00.207