PT-2019-5699 · Ntf+6 · Ntp+6

Magnus Stubman · Publicado 2019-03-10 · Atualizado 2024-06-15 · CVE-2019-8936

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NTP versions through 4.2.8p12

Description The issue is related to a NULL pointer dereference in the ntpd daemon implementation of the NTP protocol. This could allow a remote attacker to cause a denial of service. By sending specially crafted mode 6 packets, an attacker could exploit this vulnerability to cause the ntpd daemon to crash.

Recommendations For NTP versions through 4.2.8p12, consider restricting access to mode 6 packets to minimize the risk of exploitation until a patch is available. As a temporary workaround, monitor the ntpd daemon for SIGSEGV signals and restart the service if necessary to maintain availability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

ALT-PU-2019-1406

BDU:2021-00091

CVE-2019-8936

FREEBSD-SA-19_04

MGASA-2019-0140

OPENSUSE-SU-2019:1143-1

OPENSUSE-SU-2019_1143-1

OPENSUSE-SU-2019_1158-1

OPENSUSE-SU-2024:11102-1

SUSE-SU-2019:0775-1

SUSE-SU-2019:0777-1

SUSE-SU-2019:0789-1

SUSE-SU-2019:13991-1

SUSE-SU-2019:14004-1

SUSE-SU-2019_0775-1

SUSE-SU-2019_0777-1

SUSE-SU-2019_0789-1

SUSE-SU-2019_13991-1

USN-4563-1

USN-4563-2

Produtos afetados

Alt Linux

Freebsd

Ibm Aix

Linuxmint

Ntp

Suse

Ubuntu

Referências · 74

• 🔥 http://bugs.ntp.org/show_bug.cgi?id=3565 · Exploit
• https://suse.com/security/cve/CVE-2019-8936 · Nota
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBGXY7OKWOLT6X6JAPVZRFEP4FLCGGST · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4563-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-8936 · Nota de Segurança
• https://security.netapp.com/advisory/ntap-20190503-0001 · Correção
• https://suse.com/security/cve/CVE-2018-7185 · Nota
• https://bugzilla.suse.com/1128525 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-201913991-1 · Nota
• http://lists.suse.com/pipermail/sle-security-updates/2019-March/005258.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8936 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2019:1143-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8936 · Nota de Segurança
• https://suse.com/security/cve/CVE-2016-9042 · Nota
• https://suse.com/security/cve/CVE-2018-7182 · Nota