PT-2001-1013 · Ntp+1 · Ntp+1

Published 2001-04-05 · Updated 2017-10-10 · CVE-2001-0414

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ntp versions 4.0.99k and earlier xntp3 versions prior to the fixed version

Description The issue allows remote attackers to cause a denial of service and possibly execute arbitrary commands, leading to a violation of confidentiality, integrity, and availability of protected information. This can be exploited remotely.

Recommendations For ntp versions 4.0.99k and earlier, update to a version later than 4.0.99k to resolve the issue. For xntp3 versions prior to the fixed version, update to the fixed version or later to mitigate the risk. As a temporary workaround, consider restricting access to the ntpd daemon to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2015-03681

BDU:2015-07895

CVE-2001-0414

Affected Products

Ntp

Xntp3

References · 34

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/ntp/ntp_overflow.rb · Exploit
• 🔥 http://securityfocus.com/bid/2540 · Exploit
• 🔥 https://exploit-db.com/exploits/16285 · Exploit
• 🔥 https://exploit-db.com/exploits/9940 · Exploit
• 🔥 https://exploit-db.com/exploits/20727 · Exploit
• ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA2001-004.txt.asc · Vendor Advisory
• http://lists.suse.com/archives/suse-security-announce/2001-Apr/0000.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0414 · Security Note
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:31.ntpd.asc · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2001-045.html · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000392 · Vendor Advisory
• ftp://ftp.sco.com/SSE/sse074.ltr · Vendor Advisory
• ftp://ftp.sco.com/SSE/sse073.ltr · Vendor Advisory
• https://debian.org/security/2001/dsa-045 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03681 · Security Note