Actively exploited · Published Aug 11, 2017 · Assigned by symantec

CVE-2017-6327

High 8.8 Exploited

In plain English

A high-severity command injection in Messaging Gateway from Symantec Corporation. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 35.9% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)35.9%top 1.5% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 3, 2022.

Official description

The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence, after gaining access to the system, the attacker may attempt to elevate their privileges.

Affected products (as reported)

Vendor	Product	Versions
Symantec Corporation	Messaging Gateway	All versions prior to version 10.6.3-267

Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

20170817 CVE-2017-6327: Symantec Messaging Gateway <= 10.6.3-2 unauthenticated root RCE mailing-list, x_refsource_FULLDISC
42519 exploit, x_refsource_EXPLOIT-DB
100135 vdb-entry, x_refsource_BID
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00 x_refsource_CONFIRM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6327 government-resource