CVE-2017-6326 Code injection in Messaging Gateway

What is CVE-2017-6326?

CVE-2017-6326 is a critical code injection vulnerability in Symantec Corporation Messaging Gateway, published on 26 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process.

Which versions are affected by CVE-2017-6326?

It affects 1 product.

Products include Symantec Messaging Gateway.

How do I fix CVE-2017-6326?

No fix has been published for CVE-2017-6326 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-6326 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-6326 exists.

Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.

Other vulnerabilities in Symantec Corporation Messaging Gateway

• CVE-2018-12242 Auth bypass in Symantec Messaging Gateway Critical 9.8
• CVE-2018-12243 XML external entity in Symantec Messaging Gateway High 8.8
• CVE-2016-2204 Command injection in n/a High 8.2
• CVE-2012-3579 Hardcoded credentials in n/a High 7.9
• CVE-2016-2203 Information disclosure in n/a High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5pf7-r489-5rgm.