NTP Bug 2920

TALOS-CAN-0064: Invalid length data provided by a custom refclock driver could cause a buffer overflow.

  • Date Resolved: Stable (4.2.8p4) 21 Oct 2015
  • References: Sec 2920 / CVE-2015-7853
  • Affects: Potentially all ntp-4 releases running up to, but not including 4.2.8p4, and 4.3.0 up to, but not including 4.3.77 that have custom refclocks
  • CVSS: (AV:L/AC:H/Au:M/C:C/I:C/A:C) Base Score: 0.0 usual case, 5.9 unusual worst case
  • Summary: A negative value for the datalen parameter will overflow a data buffer. NTF's ntpd driver implementations always set this value to 0 and are therefore not vulnerable to this weakness. If you are running a custom refclock driver in ntpd and that driver supplies a negative value for datalen (no custom driver of even minimal competence would do this) then ntpd would overflow a data buffer. It is even hypothetically possible in this case that instead of simply crashing ntpd the attacker could effect a code injection attack.
  • Mitigation:
  • Credit: This weakness was discovered by Yves Younan of Cisco Talos.

This topic: Main > SecurityNotice > NtpBug2920
Topic revision: r1 - 2015-10-23 - 09:24:26 - HarlanStenn
SSL security by CAcert
Get the CAcert Root Certificate
This site is powered by the TWiki collaboration platform
IPv6 Ready
Copyright & 1999-2022 by the contributing authors. All material on this collaboration platform is the property of the contributing authors. Ideas, requests, problems regarding the site? Send feedback