Bug 1300267 – CVE-2015-7975 ntp: nextvar() missing length check in ntpq

Bug 1300267 - (CVE-2015-7975) CVE-2015-7975 ntp: nextvar() missing length check in ntpq

Summary:	CVE-2015-7975 ntp: nextvar() missing length check in ntpq

Status:	CLOSED NOTABUG

Aliases:	CVE-2015-7975

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20160120,reported=2...
Keywords:	Security

Depends On:	1300277
Blocks:	1297474
	Show dependency tree / graph

Reported:	2016-01-20 06:41 EST by Martin Prpič
Modified:	2016-01-21 06:35 EST (History)
CC List:	1 user (show)

See Also:
Fixed In Version:	ntp 4.2.8p6
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-01-20 09:34:17 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Martin Prpič 2016-01-20 06:41:42 EST

It was found that ntpq did not implement a proper lenght check when calling nextvar(), which executes a memcpy(), on the name buffer.

A remote attacker could potentially use this flaw to crash an ntpq client instance.

Upstream patch:

https://github.com/ntp-project/ntp/commit/12f1323d18c8d74eb14fb5ac5574183d779794c5

Comment 1 Martin Prpič 2016-01-20 06:50:49 EST

External References:

http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit
http://www.talosintel.com/reports/TALOS-2016-0072/

Comment 2 Martin Prpič 2016-01-20 07:01:48 EST

Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1300277]

Comment 3 Martin Prpič 2016-01-20 09:34:17 EST

Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7 as they do not include the affected code, which was introduced in version 4.2.8 of NTP.

Note You need to log in before you can comment on or make changes to this bug.