Bug 16676
| Summary: | Buffer overflow in msyslog.c | ||
|---|---|---|---|
| Product: | [Retired] Red Hat Linux | Reporter: | Jarno Huuskonen <jarno.huuskonen> |
| Component: | xntp3 | Assignee: | Jeff Johnson <jbj> |
| Status: | CLOSED RAWHIDE | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 6.2 | CC: | pekkas |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i386 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2000-08-23 15:54:14 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
ntp-4.0.99j-3 from Pinstripe beta is also affected. *** Bug 16752 has been marked as a duplicate of this bug. *** Fixed in ntp-4.0.99j-7. Thanks for the patch. |
Hi ! libntp/msyslog.c has a buffer overflow error. Buffer allocated for log messages is 1025 bytes. With longer messages you get an overflow. For a quick test use ntpdate `perl -e "print 'A'x10000"` Here's quick patch: --- xntp3-5.93/libntp/msyslog.c~ Tue Aug 12 09:21:29 1997 +++ xntp3-5.93/libntp/msyslog.c Mon Aug 21 16:10:31 2000 @@ -141,7 +141,8 @@ *n++ = '\n'; *n = '\0'; - vsprintf(buf, nfmt, ap); + /* Oh no ;-) */ + vsnprintf(buf, 1024, nfmt, ap); #if !defined(VMS) && !defined (SYS_VXWORKS) if (syslogit) #ifndef SYS_WINNT -Jarno