SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   ntp Vendors:   ntp.org
ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
SecurityTracker Alert ID:  1038123
SecurityTracker URL:  http://securitytracker.com/id/1038123
CVE Reference:   CVE-2016-9042, CVE-2017-6451, CVE-2017-6452, CVE-2017-6455, CVE-2017-6458, CVE-2017-6459, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464   (Links to External Site)
Date:  Mar 24 2017
Impact:   Denial of service via local system, Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.2.8p9 and prior
Description:   Multiple vulnerabilities were reported in ntp. A remote or local user can cause the target service to crash.

A remote authenticated user can set a specially crafted configuration directive to cause the target ntpd service to crash [CVE-2017-6464].

A local user that can load a specially crafted '/dev/datum/' device can trigger a buffer overflow in datum_pts_receive() in the legacy Datum Programmable Time Server refclock driver and cause denial of service conditions [CVE-2017-6462].

A remote authenticated user can send a specially crafted ':config' directive to trigger a segmentation fault on the target NTP server [CVE-2017-6463].

A local user can cause DLLs to be executed with elevated privileges and cause denial of service conditions on Windows-based systems [CVE-2017-6455].

A local user can supply specially crafted command line parameters to trigger a stack overflow in addSourceToRegistry() on Windows-based systems [CVE-2017-6452].

A remote user can cause a data structure to be terminated incorrectly on Windows-based systems [CVE-2017-6459].

A remote user can send specially crafted data to trigger an overflow in the ctl_put() function and cause the target service to crash [CVE-2017-6458].

A remote user may be able to trigger an out-of-bounds memory write error in mx4200_send() on systems with the legacy MX4200 refclock enabled and cause the target service to crash [CVE-2017-6451].

A remote ntpd server can trigger a stack buffer overflow in ntpq when return a restriction list to cause the target ntpq service to crash [CVE-2017-6460].

A remote user that can spoof servers can exploit a timestamp origin check flaw and cause timestamp reset replies to be dropped [CVE-2016-9042].

Cure53 and Matthew Van Gundy of Cisco ASIG reported these vulnerabilities.

Impact:   A remote or local user can cause the target service to crash.
Solution:   The vendor has issued a fix (4.2.8p10).

The vendor advisory is available at:

http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu

Vendor URL:  support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu (Links to External Site)
Cause:   Access control error, Boundary error, Input validation error, State error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Apr 12 2017 (FreeBSD Issues Fix) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
FreeBSD has issued a fix for FreeBSD 10.3 and 11.0.
Apr 21 2017 (Blue Coat Systems Issues Advisory for Blue Coat Director) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
Blue Coat Systems has issued an advisory for Blue Coat Director.
Jul 6 2017 (Ubuntu Issues Fix) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
Ubuntu has issued a fix for Ubuntu Linux 14.04 LTS, 16.04 LTS, 16.10, and 17.04.
Jul 11 2017 (IBM Issues Fix for IBM AIX) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
IBM has issued a fix for IBM AIX 5.3, 6.1, 7.1, and 7.2.
Oct 26 2017 (Red Hat Issues Fix) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
Red Hat has issued a fix for Red Hat Enterprise Linux 6.
Oct 26 2017 (Oracle Issues Fix for Oracle Linux) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
Oracle has issued a fix for Oracle Linux 6.
Oct 27 2017 (CentOS Issues Fix) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
CentOS has issued a fix for CentOS 6.
Apr 11 2018 (Red Hat Issues Fix) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
Red Hat has issued a fix for Red Hat Enterprise Linux 7.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC