NTP BUG 3379: Potential Overflows in ctl_put() functions (original) (raw)
Last update: April 22, 2024 18:49 UTC (7e7bd5857)
Summary
| Resolved | Potential Overflows in ctl_put() functions | 21 Mar 2017 |
|---|---|---|
| References | Bug 3379 | CVE-2017-6458 |
| Affects | All versions of NTP, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94. | Resolved in 4.2.8p10. |
| CVSS2 Score | MED 4.6 | AV:N/AC:H/Au:M/C:N/I:N/A:C) |
| CVSS3 Score | MED 4.2 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H |
Description
ntpd makes use of different wrappers around ctl_putdata() to create name/value ntpq (mode 6) response strings. For example, ctl_putstr() is usually used to send string data (variable names or string data). The formatting code was missing a length check for variable names. If somebody explicitly created any unusually long variable names in ntpd (longer than 200-512 bytes, depending on the type of variable), then if any of these variables are added to the response list it would overflow a buffer.
Mitigation
- Implement BCP-38.
- Upgrade to 4.2.8p10 or later.
- If you don’t want to upgrade, then don’t
setvarvariable names longer than 200-512 bytes in yourntp.conffile. - Properly monitor your
ntpdinstances, and auto-restartntpd(without-g) if it stops running.
Credit
This weakness was discovered by Cure53.
Timeline
- 2017 Mar 21: Public release
- 2017 Mar 06: Early Access Program Release: Premier and Partner Institutional Members
- 2017 Mar 06: Notification to Institutional Members
- 2017 Feb 09: Mozilla/Cure53 audit received