PT-2017-4153 · Ntf+7 · Ntp+7
Publicado
2017-03-27
·
Atualizado
2024-06-15
·
CVE-2017-6462
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
NTP versions prior to 4.2.8p10
NTP versions 4.3.x prior to 4.3.94
Description
The issue is related to a buffer overflow in the Datum Programmable Time Server (DPTS) refclock driver implementation of the NTP protocol. This can be exploited to cause a denial of service, allowing an attacker to crash the ntpd daemon using a crafted /dev/datum device. A remote authenticated attacker could also exploit this issue by using a malformed mode configuration directive.
Recommendations
For NTP versions prior to 4.2.8p10, update to version 4.2.8p10 or later.
For NTP versions 4.3.x prior to 4.3.94, update to version 4.3.94 or later.
As a temporary workaround, consider restricting access to the /dev/datum device to minimize the risk of exploitation.
Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Freebsd
Ibm Aix
Ntp
Red Hat
Suse
Ubuntu