Overview
There is a buffer overflow defect in the ctl_getitem() function of the Network Time Protocol (NTP) daemon responsible for providing accurate time reports used for synchronizing the clocks on installed systems. All NTP daemons based on code maintained at the University of Delaware since NTPv2 are assumed at risk.
Description
The buffer overflow condition appears in the ctl_getitem() function in ntp_control.c, the NTP control code. Because the ntp protocol uses UDP, attacks attempting to exploit this vulnerability will likely be spoofed. |
Impact
It has been reported that a remote intruder can execute arbitrary code with the default privileges on the running daemon, typically root. While this report is still being evaluated, crashing of the NTP daemon has been confirmed. |
Solution
Apply patches supplied by your vendor |
Until patches can be applied, the CERT/CC strongly urges affected sites to block ntp requests (123/{tcp,udp}) at their network perimeter or disable ntpd altogether. It is unclear at this time if using secured NTP services provides a full defense against all attacks attempting to exploit this vulnerability. |
Vendor Information
Berkeley Software Design, Inc. Affected
Updated: April 10, 2001
Status
Affected
Vendor Statement
The version of ntp shipped with BSD/OS is vulnerable to this problem
so sites which have configured ntpd should update to the patched version
available from BSDI's web, ftp or patches servers.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Compaq Computer Corporation Affected
Notified: April 05, 2001 Updated: May 03, 2001
Status
Affected
Vendor Statement
====================================================
TITLE: SSRT1-85U - xntpd potential buffer overflow
SOURCE: Compaq Computer Corporation,
Software Security Response Team
====================================================
Date: 02-MAY-2001
SEVERITY: HIGH
PROBLEM STATEMENT SUMMARY:
Compaq continues to take a serious approach to the quality
and security of all its software products and makes every
effort to address issues and provide solutions in a timely
manner. In line with this commitment, Compaq is responding
to recent concerns of a potential buffer overflow with xntpd.
The Network Time Protocol daemon for Compaq Tru64 UNIX
contains a potential buffer overflow (even though it would be
difficult to exploit) that may allow unauthorized access to bin
privileges.
IMPACT:
Compaq's Tru64 UNIX V4.0d, V4.0f, V4.0g, V5.0, V5.0a, V5.1
SOLUTION:
Compaq Tru64 UNIX engineering has provided a fix for this
potential problem.
NOTE: The solutions will be included in future releases of
Tru64 UNIX aggregate patch kits. Until that has happened
the kits identified should be reinstalled accordingly after an
upgrade to any affected version listed.
The patches identified are available from the Compaq FTP site
http://ftp1.support.compaq.com/public/dunix/ then choose the
version directory needed and search for the patch by name.
Please review the applicable readme and install files prior
to installation.
Patches:
V4.0D: DUV40D16-C0058302-10580-20010430.tar
V4.0F: DUV40F16-C0042002-10579-20010430.tar
V4.0G: T64V40G16-C0003502-10577-20010430.tar
V5.0: T64V5016-C0006102-10575-20010430.tar
V5.0A: T64V50A16-C0010402-10574-20010430.tar
V5.1: T64V513-C0027202-10573-20010430.tar
NOTE: A patch for Compaq Tru64 UNIX V4.0e is not available
as it is no longer supported by Compaq. If you require a patch
for V4.0e please contact your normal Compaq Services channel.
Compaq appreciates your cooperation and patience. We regret any
inconvenience applying this information may cause.
As always, Compaq urges you to periodically review your system
management and security procedures. Compaq will continue to
review and enhance the security features of its products and work
with customers to maintain and improve the security and integrity
of their systems.
(c) Copyright 2001 Compaq Computer Corporation. All rights reserved
To subscribe to automatically receive future NEW Security
Advisories from the Compaq's Software Security Response Team
via electronic mail,
Use your browser select the URL
http://www.support.compaq.com/patches/mailing-list.shtml
Select "Security and Individual Notices" for immediate dispatch
notifications directly to your mailbox.
To report new Security Vulnerabilities, send mail to:
security-ssrt@compaq.com
=============================================
COMPAQ AND/OR ITS RESPECTIVE SUPPLIERS MAKE
NO REPRESENTATIONS ABOUT THE SUITABILITY OF
THE INFORMATION CONTAINED IN THE DOCUMENTS
AND RELATED GRAPHICS AND/OR SOFTWARE PUBLISHED
ON THIS SERVER FOR ANY PURPOSE. ALL SUCH
DOCUMENTS AND RELATED GRAPHICS ARE PROVIDED
"AS IS" WITHOUT WARRANTY OF ANY KIND AND ARE
SUBJECT TO CHANGE WITHOUT NOTICE. THE ENTIRE RISK
ARISING OUT OF THEIR USE REMAINS WITH THE RECIPIENT.
IN NO EVENT SHALL COMPAQ AND/OR ITS RESPECTIVE
SUPPLIERS BE LIABLE FOR ANY DIRECT, CONSEQUENTIAL,
INCIDENTAL, SPECIAL, PUNITIVE OR OTHER DAMAGES
WHATSOEVER (INCLUDING WITHOUT LIMITATION,
DAMAGES FOR LOSS OF BUSINESS PROFITS, BUSINESS
INTERRUPTION, OR LOSS OF BUSINESS INFORMATION),
EVEN IF COMPAQ HAS BEEN ADVISED OF THE POSSIBILITY
OF SUCH DAMAGES.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Previously is was reported Tru64 and OpenVMS were not vulnerable to this probem.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Debian Linux Affected
Updated: April 10, 2001
Status
Affected
Vendor Statement
Debian has released an advisory on this issue: Debian Security Advisory 045-2:
Przemyslaw Frasunek <venglin@FREEBSD.LUBLIN.PL> reported that ntp
daemons such as that released with Debian GNU/Linux are vulnerable to a
buffer overflow that can lead to a remote root exploit. A previous
advisory (DSA-045-1) partially addressed this issue, but introduced a
potential denial of service attack. This has been corrected for Debian
2.2 (potato) in ntp version 4.0.99g-2potato2.
We recommend you upgrade your ntp package immediately.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Debian Security Advisory 045-2 is available at:
http://www.debian.org/security/2001/dsa-045
If you have feedback, comments, or additional information about this vulnerability, please send us email.
FreeBSD, Inc. Affected
Notified: April 05, 2001 Updated: April 13, 2001
Status
Affected
Vendor Statement
FreeBSD has released FreeBSD-SA-01:31 at:
ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01%3a31.ntpd.asc
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The FreeBSD ports collection does contain a vulnerable version of ntpd.
A patch has been made available at:
http://www.freebsd.org/cgi/cvsweb.cgi/src/contrib/ntp/ntpd/ntp_control.c?r1+=1.1&r2=1.2
This was in response to Problem Report 26358:
http://www.FreeBSD.org/cgi/query-pr.cgi?pr=26358
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Hewlett-Packard Company Affected
Updated: April 09, 2001
Status
Affected
Vendor Statement
HP is vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
HP has published HPSBUX0104-148 Sec. Vulnerability in xntpd(1M) which includes workarounds to protect users of HP systems running xntpd.
An except from HPSBUX0104-148 is included here:
A. Background
A buffer overflow has been discovered on various Unix-derived
operating systems in its NTP daemon. Hewlett-Packard Company
ships xntpd on HP-UX releases and has determined that it too,
is vulnerable.
B. Recommended solution
Hewlett-Packard Company recommends that xntpd be shut down
on all systems not absolutely needing time-of-day synchronization
with Internet standard time servers.
On those remaining time-sensitive systems modify the default
configuration file (/etc/ntp.conf) to use the "restrict" clause,
to restrict all but allow some.
We provide an example of a simple configuration. Please refer
to the man (1M) xntpd for further configuration details.
# This server syncs from server 192.255.2.3 and provides
# time services to client 192.27.16.30, yet
# blocks all others.
server 192.255.2.3 prefer
server 127.127.1.1
# allow this client full access
restrict 192.27.16.30
# allow this server full access
restrict 192.255.2.3
# you need both of the following for the localhost
restrict 127.0.0.1
restrict 127.127.1.1
# block everything else
restrict default ignore
NOTE: Patches are currently in development.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
IBM Corporation Affected
Notified: April 05, 2001 Updated: May 21, 2008
Status
Affected
Vendor Statement
IBM AIX APAR #IY18265 is the fix for this vulnerability for AIX 4.3
IBM AIX APAR #IY19744 is the fix for this vulnerability for AIX 5.1
Future releases of AIX such as 5.2 and 5.3 are not vulnerable.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Mandriva, Inc. Affected
Updated: April 06, 2001
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Please see MDKSA-2001:036: ntp/xntp3 at:
http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-036.php3
If you have feedback, comments, or additional information about this vulnerability, please send us email.
NetBSD Affected
Notified: April 05, 2001 Updated: April 05, 2001
Status
Affected
Vendor Statement
Please see NetBSD Security Advisory 2001-004 at:
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
OpenBSD Affected
Notified: April 05, 2001 Updated: April 06, 2001
Status
Affected
Vendor Statement
No statement from the vendor is available at this time.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The OpenBSD ports collection does contain a vulnerable version of xntp.
The following extract was taken from the GNATs bug report about this issue:
http://cvs.openbsd.org/cgi-bin/wwwgnats.pl/full?pr=1758
Here is an addition to the OpenBSD xntpd port that applies
NAKAMURA Kazushi's patch.
How to apply:
# Add the new file: /usr/ports/sysutils/xntpd/patches/patch-ntp_control.c
cd /usr/ports/sysutils/xntpd
make uninstall && make clean && make && make install
reboot # necessary because tickadj is run before system securelevel is changed
Caveats:
The new file /usr/ports/sysutils/xntpd/patches/patch-ntp_control.c is
NAKAMURA Kazushi's patch -- nothing more. It comes directly from the
FreeBSD tree. It may not be OpenBSD's preferred way of doing things,
but it will close the hole until OpenBSD has it fixed.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Red Hat, Inc. Affected
Notified: April 05, 2001 Updated: April 09, 2001
Status
Affected
Vendor Statement
No direct statement is currently available from the vendor regarding this vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
RedHat has issued an advisory regarding this issue at:
http://www.redhat.com/support/errata/RHSA-2001-045.html
An excerpt:
The Network Time Daemon (xntpd on Red Hat Linux 6.2 and earlier, ntpd on
Red Hat Linux 7.0) does not properly check the size of a buffer used to
hold incoming data from the network. Potentially, an attacker could gain
root access by exploiting this weakness.
Potential damage is mitigated by the fact that the Network Time Daemon is
not enabled by default. If you are not using network time services, it
may not even be installed. As a general rule, Red Hat encourages users to
enable only those network services they actually need.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
SUSE Linux Affected
Updated: April 16, 2001
Status
Affected
Vendor Statement
No statement has been directly received from the vendor regarding this vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
SuSE has released a Security Announcement on this issue: SuSE-SA:2001:10 at
http://lists.suse.com/archives/suse-security-announce/2001-Apr/0000.html
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: xntp
Announcement-ID: SuSE-SA:2001:10
Date: Monday, April 9th 22:30 MEST
Affected SuSE versions: (6.0, 6.1, 6.2), 6.3, 6.4, 7.0, 7.1
Vulnerability Type: remote root compromise
Severity (1-10): 8
SuSE default package: no
Other affected systems: systems using xntp in newer versions
Content of this advisory:
1) security vulnerability resolved: xntp
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
xntp is the network time protocol package widely used with many unix
and linux systems for system time synchronization over a network.
An exploit published by Przemyslaw Frasunek demonstrates a buffer
overflow in the control request parsing code. The exploit allows a
remote attacker to execute arbitrary commands as root. All versions as
shipped with SuSE Linux are affected by the buffer overflow problem.
A temporary workaround is to kill the daemon and to set the variable
START_XNTPD in the file /etc/rc.config to "no" so that the daemon
will not be started again upon reboot of the system. Correct the system
time manually if necessary or adjust the time by running ntpdate from
a cron job on a regular basis.
We believe that this problem is generally underestimated since the
xntpd daemon tends to get forgotten over the years of a system's life-
time once installed and configured. The xntpd daemon is not started by
default in SuSE Linux distributions. We strongly recommend to immediately
update the xntp package on each system where the daemon is installed,
configured and running.
Note:
The xntp update packages for most distributions have been available
for download since Friday last week. The packages for all 6.4 and 7.0
version distributions had to be rebuilt due to a specfile bug that
did not show up earlier and that caused a delay in building packages.
This bug causes the rpm subsystem to complain about the release number
of the package. Now that this bug is corrected, you might find yourself
having installed a package where there is a newer version of the package
on the ftp server. However, regardless of the package release number,
all published packages fix the currently known security problems in the
xntpd network time daemon.
Note:
The source rpm of xntp in newer distributions generates two packages:
xntp.rpm and xntpdoc.rpm. It is not necessary to update the xntpdoc
package which is why we do not provide the update packages on our ftp
server. The xntpdoc package only contains the documentation for the
xntp package and did not change in this updated package.
Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
SPECIAL INSTALL INSTRUCTIONS:
==============================
The xntpd daemon must be restarted for the new package to become
active after the installation of the update rpm. You can do this
by running the command
kill -15 `pidof xntpd`
as root. After performing the upgrade using the rpm command above,
you can restart the xntpd:
rcxntpd start
You should now see the new daemon synchronizing in your syslogs,
depending on where you configured the daemon to write its logs to.
i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/xntp-4.0.99f-34.i386.rpm
9e39ca8f7b01fef22766463b8295e25d
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/xntp-4.0.99f-34.src.rpm
dfa51b46c92b917353f52e5d83863478
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/xntp-4.0.99f-37.i386.rpm
4293ad8a3e084ec5d773bbcab8380c08
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/xntp-4.0.99f-37.src.rpm
745b894dcb6a97caa36f97858a51e279
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/xntp-4.0.99f-38.i386.rpm
8001ac19d0ee812be82b6b066b4313d5
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/xntp-4.0.99f-38.src.rpm
7d56618cba3d768aa53246f39158987d
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/xntp-4.0.98d-1.i386.rpm
2f5d7b43b167c6acf13f68b13b1b7989
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/xntp-4.0.98d-1.src.rpm
11182e5e8c3769e6f9498ade9fcbe1fc
SuSE-6.2 (unsupported platform)
ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/xntp-4.0.93a-18.i386.rpm
5b55d179e3d4a0c57513bed03013c1a9
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/xntp-4.0.93a-18.src.rpm
dbb7c833ddc25b0bde406b4319d4106f
SuSE-6.1 (unsupported platform)
ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/xntp-4.0.92c-1.i386.rpm
baa93b55a4eaa486968fa6285f04c865
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/xntp-4.0.92c-1.src.rpm
06f0174e8934e3ce6f419284564a7c91
Sparc Platform:
SuSE-7.1
The xntp packages for the SuSE-7.1 sparc distribution are currently
pending for being built. They will be available on the ftp server
as soon as they are built. The packages are gpg-signed using the key
<build@suse.de> that should have been installed on your system upon
system installation/upgrade. Use the command `rpm --checksig xntp.rpm´
to verify this signature once the packages are available for download.
In the meanwhile, please use the temporary workaround as described above.
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/xntp-4.0.99f-19.sparc.rpm
bea9ea6a88ae68f27962d1b9ad866eac
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/xntp-4.0.99f-19.src.rpm
83243db2982126e1a6ba371ef6dcf59b
AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/xntp-4.0.99f-22.alpha.rpm
e410a96c44f12ba3d51a4f1f3e056fcd
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/xntp-4.0.99f-22.src.rpm
61ed8e66753868735cd14e94cb295718
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/xntp-4.0.99f-22.alpha.rpm
9460bd3eaf5500c0184d9394b8b86627
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/xntp-4.0.99f-22.src.rpm
5c62ef99f064b687047087562cfe54ca
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/xntp-4.0.98d-1.alpha.rpm
ad8c8494f0aaa06a1690e4edcaa43904
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/xntp-4.0.98d-1.src.rpm
743fe2aba27f1801ac5b14cff2f2edb6
SuSE-6.1 (unsupported platform)
ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/xntp-4.0.92c-40.alpha.rpm
d400eeecb9bd0b4347f3fe58f7f90fee
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/xntp-4.0.92c-40.src.rpm
e2d01c31542ebbf8c740b820a6372ad1
PPC Power PC Platform:
SuSE-7.1
The xntp packages for the SuSE-7.1 ppc distribution are currently
pending for being built. They will be available on the ftp server
as soon as they are built. The packages are gpg-signed using the key
<build@suse.de> that should have been installed on your system upon
system installation/upgrade. Use the command `rpm --checksig xntp.rpm´
to verify this signature once the packages are available for download.
In the meanwhile, please use the temporary workaround as described above.
SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/xntp-4.0.99f-21.ppc.rpm
2d82e8f63df84cb409df7659437c1177
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/xntp-4.0.99f-21.src.rpm
a0bce6c36cf30da1aa587e03103a01f6
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/xntp-4.0.99f-21.ppc.rpm
fe9082268bdf53dddcaad075284f899b
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/xntp-4.0.99f-21.src.rpm
1940b97593e3e134487d294a721e350d
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- kernel
Please expect security updates of the Linux kernel soon. To resolve all
currently known security problems in the Linux kernel, update the kernel
manually to version 2.2.19 or wait until the SuSE update rpm packages
for the supported distributions 6.3, 6.4, 7.0 and 7.1 are ready to be
used and available for download.
- more updates
In addition to the kernel update, please expect more packages to see
security updates. Currently, this involves vim, mc and sudo.
- bind8
The update packages for the 7.0 sparc distribution is available.
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/bind8-8.2.3-39.sparc.rpm
c7e2a95bd4b90d03207ffc3a9880c36c
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/bind8-8.2.3-39.src.rpm
5d4d4b608f2a8a3e61f7dc6917254f4f
The SuSE-7.1 sparc distribution was published after the bugs in bind8
were corrected.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security@suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe@suse.com>.
suse-security-announce@suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe@suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info@suse.com> or
<suse-security-faq@suse.com> respectively.
===============================================
SuSE's security contact is <security@suse.com>.
===============================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security@suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOtIdLXey5gA9JdPZAQGX0Af/RbqT5xox/JWc6gz7QGxA/TCKrLvk3rO3
RBesK0QJ/GqEWZh3CI81CyXCHZiyOkKzmUo5+BhX5NU4OnmuvVokofTk/cAQxh1M
6HzcUySvNrru79VwSuFE1nFGuyzWSDkKAAgD2/mP0fSporpinJTeVJm/JkXH3jau
sOq+eIzhi7grtnVgbIueGR8mGrAg8COLlCx7GjYLd+VQxeS+eOtT16sLY4gMDV43
RDzpRA5dWFh48KGkncA5/0Cuvs46LTmBkVDgyflgyG1h+dmrSlfXSvoLyo08lupy
ekFi4zg2H91Bb7SX0FFs456R42S02arJyld2/xm8IR9fkR18Ve12gg==
=6ds6
-----END PGP SIGNATURE-----
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Slackware Affected
Updated: April 09, 2001
Status
Affected
Vendor Statement
No direct statement is currently available from the vendor regarding this vulnerability.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Slackware has issued the following advisory regarding this problem:
http://www.slackware.com/lists/archive/viewer.php?l=slackware-security&y=2001&m=slackware-security.384116
An excerpt:
The version of xntp3 that shipped with Slackware 7.1 as well as the
version that was in Slackware -current contains a buffer overflow bug that
could lead to a root compromise. Slackware 7.1 and Slackware -current
users are urged to upgrade to the new packages available for their
release.
The updated package available for Slackware 7.1 is a patched version of
xntp3. The -current tree has been upgraded to ntp4, which also fixes the
problem. If you want to continue using xntp3 on -current, you can use the
updated package from the Slackware 7.1 tree and it will work.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Sun Microsystems, Inc. Affected
Notified: April 05, 2001 Updated: October 31, 2001
Status
Affected
Vendor Statement
Please see Sun Security Bulletin #00211, also available for download at:
http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?type=0&doc=secbull%2F211&display=plain
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Download: 
-----BEGIN PGP SIGNED MESSAGE-----
________________________________________________________________________________
Sun Microsystems, Inc. Security Bulletin
Bulletin Number: #00211
Date: October 23, 2001
Cross-Ref: CERT Vulnerability Note VU#970472
Title: xntpd
________________________________________________________________________________
The information contained in this Security Bulletin is provided "AS IS."
Sun makes no warranties of any kind whatsoever with respect to the information
contained in this Security Bulletin. ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY WARRANTY OF NON-INFRINGEMENT OR
IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE
HEREBY DISCLAIMED AND EXCLUDED TO THE EXTENT ALLOWED BY APPLICABLE LAW.
IN NO EVENT WILL SUN MICROSYSTEMS, INC. BE LIABLE FOR ANY LOST REVENUE,
PROFIT OR DATA, OR FOR DIRECT, SPECIAL, INDIRECT, CONSEQUENTIAL, INCIDENTAL
OR PUNITIVE DAMAGES HOWEVER CAUSED AND REGARDLESS OF ANY THEORY OF LIABILITY
ARISING OUT OF THE USE OF OR INABILITY TO USE THE INFORMATION CONTAINED IN
THIS SECURITY BULLETIN, EVEN IF SUN MICROSYSTEMS, INC. HAS BEEN ADVISED OF
THE POSSIBILITY OF SUCH DAMAGES.
If any of the above provisions are held to be in violation of applicable law,
void, or unenforceable in any jurisdiction, then such provisions are waived
to the extent necessary for this disclaimer to be otherwise enforceable in
such jurisdiction.
________________________________________________________________________________
1. Bulletins Topics
Sun announces the release of patches for Solaris(tm) 8, 7, and
2.6 (SunOS(tm) 5.8, 5.7, and 5.6) which relate to a vulnerability
in xntpd(1M), the Network Time Protocol daemon.
Sun recommends that you install the patches listed in section 4
on systems running SunOS 5.8, 5.7, and 5.6 which use xntpd.
2. Who is Affected
Vulnerable: SunOS 5.8, 5.8_x86, 5.7, 5.7_x86, 5.6,
5.6_x86
The xntpd(1M) daemon was not shipped by Sun for earlier releases
than Solaris 2.6.
3. Understanding the Vulnerability
The xntpd is a daemon which sets and maintains a UNIX system
time-of-day in agreement with Internet standard time servers.
xntpd is a complete implementation of the Network Time Protocol
(NTP) version 3 standard, as defined by RFC 1305.
CERT Vulnerability Note VU#970472 is available from:
http://www.kb.cert.org/vuls/id/970472
4. List of Patches
The following patches are available in relation to the above issue.
OS Version Patch ID
__________ _________
SunOS 5.8 109667-04
SunOS 5.8_x86 109668-04
SunOS 5.7 109409-04
SunOS 5.7_x86 109410-03
SunOS 5.6 107298-03
SunOS 5.6_x86 107299-03
_______________________________________________________________________________
APPENDICES
A. Patches listed in this bulletin are available to all Sun customers at:
http://sunsolve.sun.com/securitypatch
B. Checksums for the patches listed in this bulletin are available at:
ftp://sunsolve.sun.com/pub/patches/CHECKSUMS
C. Sun security bulletins are available at:
http://sunsolve.sun.com/security
D. Sun Security Coordination Team's PGP key is available at:
http://sunsolve.sun.com/pgpkey.txt
E. To report or inquire about a security problem with Sun software, contact
one or more of the following:
- Your local Sun answer centers
- Your representative computer security response team, such as CERT
- Sun Security Coordination Team. Send email to:
security-alert@sun.com
F. To receive information or subscribe to our CWS (Customer Warning System)
mailing list, send email to:
security-alert@sun.com
with a subject line (not body) containing one of the following commands:
Command Information Returned/Action Taken
_______ _________________________________
help An explanation of how to get information
key Sun Security Coordination Team's PGP key
list A list of current security topics
query [topic] The email is treated as an inquiry and is forwarded to
the Security Coordination Team
report [topic] The email is treated as a security report and is
forwarded to the Security Coordination Team. Please
encrypt sensitive mail using Sun Security Coordination
Team's PGP key
send topic A short status summary or bulletin. For example, to
retrieve a Security Bulletin #00138, supply the
following in the subject line (not body):
send #138
subscribe Sender is added to our mailing list. To subscribe,
supply the following in the subject line (not body):
subscribe cws your-email-address
Note that your-email-address should be substituted
by your email address.
unsubscribe Sender is removed from the CWS mailing list.
________________________________________________________________________________
Copyright 2001 Sun Microsystems, Inc. All rights reserved. Sun,
Sun Microsystems, Solaris and SunOS are trademarks or registered trademarks
of Sun Microsystems, Inc. in the United States and other countries. This
Security Bulletin may be reproduced and distributed, provided that this
Security Bulletin is not modified in any way and is attributed to
Sun Microsystems, Inc. and provided that such reproduction and distribution
is performed for non-commercial purposes.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
iQCVAwUBO9XChbdzzzOFBFjJAQElsAP+MZjJdkGGRAiIIxMqQ2uMN3c6fnOuj0aQ
RPdePjnB7shoiRIAm2tYaJdwh8+d8m5PlQFCdOk+VVn50x6qRTsMWea8wCSD/Zzp
osIjqZePvryLFkV0wiira4vz2ify5gzjPm4OOvGjMbEn1jP9EJB2SMn7vk3XnpKC
aw+Kk5BHoN8=
=8C0I
-----END PGP SIGNATURE-----
If you have feedback, comments, or additional information about this vulnerability, please send us email.
The SCO Group (SCO Linux) Affected
Notified: April 05, 2001 Updated: April 09, 2001
Status
Affected
Vendor Statement
We have now released updated packages:
Caldera OpenLinux 2.3
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/
19e51b89951b435061450398e764b753 RPMS/xntp-3.5.93e-5.i386.rpm
08a990b5034679c0a37ebbe20e162d05 SRPMS/xntp-3.5.93e-5.src.rpm
Caldera OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/
df892fae73626a11107552d7d1a68e6e RPMS/xntp-3.5.93e-5.i386.rpm
663eb55d629cdcc0212583e92be15d11 SRPMS/xntp-3.5.93e-5.src.rpm
Caldera OpenLinux eDesktop 2.4
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/
fe7cffdf379ee9b69890f9fa9ff0f320 RPMS/xntp-4.0.97-2.i386.rpm
ff34841b2f01a252e6e31cb91ffcada5 SRPMS/xntp-4.0.97-2.src.rpm
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Further details can be found in CSSA-2001-013 remote root exploit in ntpd available at:
http://www.caldera.com/support/security/advisories/CSSA-2001-013.0.txt
If you have feedback, comments, or additional information about this vulnerability, please send us email.
The SCO Group (SCO Unix) Affected
Updated: April 16, 2001
Status
Affected
Vendor Statement
We have not received a statement from the vendor.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has read but not verified the following statement from SCO posted on BUGTRAQ:
Message-Id: <3AD4B69C.913A849D@sco.com>
Date: Wed, 11 Apr 2001 12:55:08 -0700
From: Albert Fu <alf@sco.COM>
Organization: SCO
X-Mailer: Mozilla 4.7 [en] (X11; I; SCO_SV 3.2 i386)
X-Accept-Language: en
To: BUGTRAQ@SECURITYFOCUS.COM
Sender: owner-bugtraq@SECURITYFOCUS.COM
Subject: SSE073: SCO OpenServer NTP buffer overflow fix
---------------------------------------------------
TOPIC: NTP remote buffer overflow
PRODUCTS AFFECTED: SCO OpenServer 5.0.0->5.0.6
PATCH: System Security Supplement (SSE) SSE073
PATCH LOCATION: ftp://ftp.sco.com/SSE/sse073.tar.Z
ftp://ftp.sco.com/SSE/sse073.ltr
SUMMARY: potentially exploitable buffer overflow fixed by SSE073
DATE: April 11, 2001
---------------------------------------------------
System Security Enhancement (SSE) SSE073 - 11-Apr-2001
Problem:
A buffer overflow was found by Przemyslaw Frasunek
<venglin@freebsd.lublin.pl> in the NTP daemon. Full exploit details
can be found in the BUGTRAQ archive
http://www.securityfocus.com/archive/1/174011
On SCO OpenServer 5 Release 5.0.6 systems, the NTP daemon is /etc/ntpd.
This exploit doesn't actually "work" on OpenServer. However, a small
effect can be observed.
To observe the effect, run ntpdc and give it the "ctlstats" command.
An exploit attempt registers as an increment of 2 to the
"requests received" and "responses sent" counters.
Running the fixed version of ntpd, an exploit attempt registers as +2
"requests received", +2 "responses sent", +1 "total bad pkts" and +1
"error msgs sent".
We find this difference sufficient to feel confident that the _specific_
problem has been corrected.
Patch:
The patch is located at: ftp://ftp.sco.com/SSE/sse073.tar.Z
ftp://ftp.sco.com/SSE/sse073.ltr
This patch is applicable to all releases of OpenServer 5.
However, the "install-sse073.sh" program to install the binary
can be used on Release 5.0.6 ONLY.
This patch contains a replacement for the /etc/ntpd binary in
Release 5.0.6. If you wish to use this binary on Releases 5.0.0
up to 5.0.5, you can install the binary manually. Note that
on these older releases, /etc/xntpd (based on NTPv3) was shipped
by default; hence, configuration files based on xntpd may have to
be modified.
Installation:
1. We reccommend you drop into single user mode to install this SSE
(though this is not enforced).
2. Uncompress and extract the SSE into a temporary directory
of the server (eg. /tmp/sse073).
# uncompress sse073.tar.Z
# tar xvf sse073.tar
3. Execute the install script. Follow the instructions
at the prompt.
# ./install-sse073.sh
Note: "Warning" messages simply explain that because a
specific file was not found on the current
server, it was not replaced. If a system has
custom binaries or paths, this patch may not
succeed.
4. Clean up.
A backup of the orginal binaries will be saved in:
/opt/K/SCO/sse/sse073
The following files will be left over after patch
installation and can be removed:
./install-sse073.sh
./sse073.files.tar
The following files will be left over after patch
installation and can be moved to an archival
directory in case the patches are needed again:
./sse073.tar
./sse073.doc
Checksums of the packages:
`sum -r ./sse073.tar`: 53459
`sum -r ./sse073.files.tar`: 61075
References:
The vulnerability addressed in this patch was found by:
Przemyslaw Frasunek <venglin@freebsd.lublin.pl>
For more details, see the following BUGTRAQ archive:
http://www.securityfocus.com/archive/1/174011
Disclaimer:
SCO believes that this patch addresses the reported vulnerabilities.
However, in order that it be released as soon as possible, this patch
has not been fully tested or packaged to SCO's normal exacting
standards. For that reason, this patch is not officially supported.
Official supported and packaged fixes for current SCO products will
be available in due course.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
University of Delaware Affected
Updated: April 09, 2001
Status
Affected
Vendor Statement
The patch I sent out applies to the NTPv4 99k distribution which for
safety I fetched directly from its public place. For record:
--- ntp_control.c.1Thu Apr 5 21:41:56 2001
+++ ntp_control.cThu Apr 5 21:43:02 2001
@@ -1824,6 +1824,8 @@
while (cp < reqend && *cp !=
',')
*tp++ = *cp++;
+if (tp >= buf + sizeof(buf))
+return (0);
if (cp < reqend)
cp++;
*tp = '\0';
Not fancy; it's been a long day.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
Target CVS repository:
http://maccarony.ntp.org/cgi-bin/cvsweb.cgi/ntp/ntpd/ntp_control.c?rev=1.33&content-type=text/x-cvsweb-markup
Target patched version:
ftp://ftp.udel.edu/pub/ntp/ntp4/ntp-4.0.99k23.tar.gz
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Fujitsu Not Affected
Updated: April 06, 2001
Status
Not Affected
Vendor Statement
Regarding the ntpd buffer overflow vulnerability, Fujitsu's UXP/V
operating system is not vulnerable because it doesn't support ntpd.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
Cisco Systems, Inc. Unknown
Updated: April 13, 2001
Status
Unknown
Vendor Statement
IOS is not vulnerable to the ntpdx exploit as it is posted to the Bugtraq. However, to be
on the safe side, we recommend that you include this line in your config:
ntp access-group serve-only
This will allow only time requests but ignore control queries.
Vendor Information
The vendor has not provided us with any further information regarding this vulnerability.
Addendum
The CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us email.
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
- ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA2001-004.txt.asc
- http://www.freebsd.org/cgi/cvsweb.cgi/src/contrib/ntp/ntpd/ntp_control.c?r1+=1.1&r2=1.2
- http://www.FreeBSD.org/cgi/cvsweb.cgi/ports/net/ntp/files/patch-ntp_control.c (patch for ntp-4.0.99k)
- http://www.faqs.org/rfcs/rfc1305.html
- http://www.ntp.org/
- http://www.securityfocus.com/bid/2540
- http://sunsolve.Sun.COM/pub-cgi/retrieve.pl?type=0&doc=secbull%2F211&display=plain
Acknowledgements
The CERT/CC thanks Przemyslaw Frasunek for reporting this issue.
This document was written by Jeffrey S. Havrilla
Other Information
| CVE IDs: | CVE-2001-0414 |
| Severity Metric: | 79.65 |
| Date Public: | 2001-04-04 |
| Date First Published: | 2001-04-05 |
| Date Last Updated: | 2008-05-22 16:42 UTC |
| Document Revision: | 35 |