CVE-2017-6553

CVE-2017-6553 describes a critical buffer overflow vulnerability in Quest One Identity Privilege Manager for Unix versions prior to 6.0.0.061. This flaw allows unauthenticated remote attackers to achieve full administrative access to the policy server by sending a specially crafted ACT_ALERT_EVENT request that corrupts memory within the pmmasterd daemon. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity and no user interaction, leading to complete compromise of confidentiality, integrity, and availability. Exploit code is publicly available, including a Metasploit module, and the vulnerability has garnered significant community discussion, indicating a high potential for exploitation despite not being on the CISA KEV catalog.