| Description: | Summary:
NTP.org's reference implementation of NTP server, ntpd is prone to multiple denial of service vulnerabilities.
Vulnerability Insight:
Multiple flaws exist due to
- Improper handling of a malformed mode configuration directive.
- A buffer overflow error in Legacy Datum Programmable Time Server refclock
driver.
- Improper handling of an invalid setting via the :config directive.
- Incorrect pointer usage in the function 'ntpq_stripquotes'.
- No allocation of memory for a specific amount of items of the same size in
'oreallocarray' function.
- ntpd configured to use the PPSAPI under Windows.
- Limited passed application path size under Windows.
- An error leading to garbage registry creation in Windows.
- Copious amounts of Unused Code.
- Off-by-one error in Oncore GPS Receiver.
- Potential Overflows in 'ctl_put' functions.
- Improper use of 'snprintf' function in mx4200_send function.
- Buffer Overflow in ntpq when fetching reslist from a malicious ntpd.
- Potential Overflows in 'ctl_put' functions.
- Potential denial of service in origin timestamp check functionality of ntpd.
Vulnerability Impact:
Successful exploitation will allow remote
attackers to conduct denial of service condition.
Affected Software/OS:
NTPd version 4.x prior to 4.2.8p10 and 4.3.x prior to
4.3.94.
Solution:
Update to version 4.2.8p10, 4.3.94 or later.
CVSS Score:
6.5
CVSS Vector:
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
