CVE-2017-6451

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.

A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution (CVE-2017-6451).

A vulnerability was found in NTP, in the building of response packets with custom fields. If custom fields were configured in ntp.conf with particularly long names, inclusion of these fields in the response packet could cause a buffer overflow, leading to a crash (CVE-2017-6458).

A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash (CVE-2017-6462).

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message (CVE-2017-6463).

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message (CVE-2017-6464).

These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

This ntp update to version 4.2.8p10 fixes the following issues:

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• Fixing ppc and ppc64 linker issue (bsc#1031085).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.