xntpd '-u' Switch May Cause the Daemon to Run With Incorrect Group Privileges
|
|
SecurityTracker Alert ID: 1016679
|
|
SecurityTracker URL: http://securitytracker.com/id?1016679
|
|
CVE Reference: CVE-2005-2496
(Links to External Site)
|
|
OSVDB Reference: 19055
(Links to External Site)
|
Updated: Aug 11 2006
|
Original Entry Date: Aug 11 2006
|
Impact: User access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 4.2.0b
|
Description: A vulnerability was reported in xntpd. The daemon may run with the incorrect group privileges.
A local user can invoke the daemon with the '-u' switch to cause the daemon to operate with the group privileges of the local user
instead of the specified group id. As a result, the daemon may run with different privileges than intended.
This vulnerability
was originally reported in September 2005.
This vulnerability was discovered by SUSE developers.
|
Impact: The daemon may run with the incorrect group privileges.
|
Solution: The vendor has issued a fixed version (4.2.0b).
|
Vendor URL: www.ntp.org/ (Links to External Site)
|
Cause: Access control error, State error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 10 Aug 2006 20:58:21 -0400
Subject: xntpd vulnerability
|
[reported in September 2005]
CVE-2005-2496
> The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a
> string to specify the group, uses the group ID of the user instead of the group,
> which causes xntpd to run with different privileges than intended.
|
|
