CVE-2017-6553 Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory c...

CriticalCVSS 9.8 EPSS 42.3% Framework module Public exploit

Published: 2017-04-29 19:00
Updated: 2026-06-17 04:22
Exploit status: Public exploit available

Description

Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.

Affected products

Product	Affected versions	Fixed in
Quest privilege manager for unix	<= 6.0.0-50	No fix listed

References

0xdeadface.wordpress.com third-party-advisory
support.oneidentity.com patch vendor-advisory
42010 exploit

CVSS v3.0

9.8 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (2)

v3.0 9.8 · nvd@nist.gov
v2.0 10.0 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 42.29% (percentile 98.7)
CWE: CWE-119

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Quest Privilege Manager pmmasterd Buffer Overflow Framework module · Metasploit Framework (Rapid7) · 2017-04-09
Quest Privilege Manager - pmmasterd Buffer Overflow (Metasploit) Exploit · Exploit Database (OffSec) · 2017-05-15