CVE-2017-6327
Symantec Messaging Gateway Remote Code Execution Vulnerability
Description
CVE-2017-6327 is a high-severity remote code execution vulnerability in Symantec Messaging Gateway before version 10.6.3-267. The vulnerability allows an authenticated attacker to execute arbitrary commands on the target system and potentially escalate privileges. CISA has added CVE-2017-6327 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 76.8% (98.9th percentile), this vulnerability has a very high probability of exploitation, making it a priority remediation target for organizations using Symantec Messaging Gateway.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| symantec | message gateway | < 10.6.3-267 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://seclists.org/fulldisclosure/2017/Aug/28(Mailing List, Third Party Advisory)
- http://www.securityfocus.com/bid/100135(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/42519/(Third Party Advisory, VDB Entry)
- https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-6327(US Government Resource)
Weakness Type
CWE-77: Improper Neutralization of Special Elements used in a Command (Command Injection)
Command Injection occurs when an application passes unsanitized user-controlled input to a system shell or command execution function. In the case of Symantec Messaging Gateway, the vulnerability allows an authenticated user to inject and execute arbitrary commands on the underlying operating system, which can then be leveraged for privilege escalation and full system compromise.
Learn more: CWE-77 — Improper Neutralization of Special Elements used in a Command
Impact Analysis
CVE-2017-6327 carries a CVSS 3.1 score of 8.8 (HIGH), reflecting a serious security threat. The vulnerability is remotely exploitable over the network with low attack complexity, though it requires low-level authentication privileges. No user interaction is needed for exploitation. Successful exploitation allows an attacker to execute arbitrary commands on the Symantec Messaging Gateway server, resulting in high impact to confidentiality, integrity, and availability. After gaining initial code execution, an attacker may escalate privileges to gain complete control over the system. The EPSS score of 76.8% (98.9th percentile) indicates a very high probability of exploitation activity, emphasizing the critical nature of this vulnerability despite its HIGH rather than CRITICAL CVSS rating.
Exploit Maturity
Public exploit code is available for CVE-2017-6327 via Exploit-DB. CISA has confirmed active exploitation by adding the vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of 2022-05-03. The EPSS score of 76.8% (98.9th percentile) indicates a very high probability of exploitation activity. The combination of publicly available exploit code, confirmed active exploitation, and the widespread deployment of Symantec Messaging Gateway in enterprise environments makes this a high-priority threat.
Remediation
- Apply updates per vendor instructions as mandated by CISA KEV. Upgrade Symantec Messaging Gateway to version 10.6.3-267 or later, which addresses the remote code execution vulnerability.
- Verify that all Symantec Messaging Gateway instances in your environment are running version 10.6.3-267 or newer, as all prior versions are affected.
- Restrict access to the Symantec Messaging Gateway administration interface to trusted internal networks and authorized administrator accounts only, implementing network segmentation to limit exposure.
- Review authentication logs for the Messaging Gateway for signs of unauthorized access or unusual command execution patterns that may indicate exploitation attempts.
- Implement application-level monitoring to detect anomalous process spawning or command execution originating from the Messaging Gateway service, as these may indicate post-exploitation activity.
Technical Details
CVE-2017-6327 is a command injection vulnerability in Symantec Messaging Gateway versions prior to 10.6.3-267. The flaw allows an authenticated user to inject operating system commands through improperly sanitized input fields in the application interface. The CVSS vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the vulnerability is network-accessible with low exploitation complexity, though it requires low-level privileges (authentication). Once commands are executed, the attacker gains the ability to run arbitrary code on the underlying system, and may then attempt to escalate privileges to root or system-level access. The scope is unchanged, meaning the impact is confined to the vulnerable Messaging Gateway component, but given that email gateways typically process sensitive communications, the potential for data exfiltration and lateral movement is substantial.
Frequently Asked Questions
Is CVE-2017-6327 being actively exploited?
Yes. CVE-2017-6327 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available on Exploit-DB, and the EPSS score of 76.8% (98.9th percentile) indicates a very high probability of exploitation.
What products are affected by CVE-2017-6327?
CVE-2017-6327 affects Symantec Messaging Gateway versions prior to 10.6.3-267. All earlier versions of the Messaging Gateway product are vulnerable to this remote code execution flaw.
How do I fix CVE-2017-6327?
Upgrade Symantec Messaging Gateway to version 10.6.3-267 or later. Restrict access to the administration interface to trusted networks and authorized users. Monitor authentication and command execution logs for signs of exploitation.
How severe is CVE-2017-6327?
CVE-2017-6327 has a CVSS 3.1 score of 8.8 (HIGH) and an EPSS score of 76.8% (98.9th percentile). While it requires low-level authentication, the ability to execute arbitrary commands and escalate privileges makes it a critical remediation priority.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.