PT-2019-5699 · Ntf+6 · Ntp+6

Magnus Stubman · Published 2019-03-10 · Updated 2024-06-15 · CVE-2019-8936

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NTP versions through 4.2.8p12

Description The issue is related to a NULL pointer dereference in the ntpd daemon implementation of the NTP protocol. This could allow a remote attacker to cause a denial of service. By sending specially crafted mode 6 packets, an attacker could exploit this vulnerability to cause the ntpd daemon to crash.

Recommendations For NTP versions through 4.2.8p12, consider restricting access to mode 6 packets to minimize the risk of exploitation until a patch is available. As a temporary workaround, monitor the ntpd daemon for SIGSEGV signals and restart the service if necessary to maintain availability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-1406

BDU:2021-00091

CVE-2019-8936

FREEBSD-SA-19_04

MGASA-2019-0140

OPENSUSE-SU-2019:1143-1

OPENSUSE-SU-2019_1143-1

OPENSUSE-SU-2019_1158-1

OPENSUSE-SU-2024:11102-1

SUSE-SU-2019:0775-1

SUSE-SU-2019:0777-1

SUSE-SU-2019:0789-1

SUSE-SU-2019:13991-1

SUSE-SU-2019:14004-1

SUSE-SU-2019_0775-1

SUSE-SU-2019_0777-1

SUSE-SU-2019_0789-1

SUSE-SU-2019_13991-1

USN-4563-1

USN-4563-2

Affected Products

Alt Linux

Freebsd

Ibm Aix

Linuxmint

Ntp

Suse

Ubuntu

References · 74

• 🔥 http://bugs.ntp.org/show_bug.cgi?id=3565 · Exploit
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBGXY7OKWOLT6X6JAPVZRFEP4FLCGGST · Vendor Advisory
• https://osv.dev/vulnerability/USN-4563-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-8936 · Security Note
• https://security.netapp.com/advisory/ntap-20190503-0001 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8936 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1143-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8936 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00032.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4563-2 · Vendor Advisory
• http://support.ntp.org/bin/view/Main/SecurityNotice · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8936 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-8936 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2NVS2CSG2TQ663CXOZZUJN4STQPMENNP · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8936 · Vendor Advisory