Bug 1435561 (CVE-2017-6455) - CVE-2017-6455 ntp: Privileged execution of User Library code
Summary: CVE-2017-6455 ntp: Privileged execution of User Library code
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2017-6455
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-03-24 08:59 UTC by Andrej Nemec
Modified: 2021-02-17 02:25 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-03-24 09:05:41 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2017-03-24 08:59:25 UTC 
The Windows NT port has the added capability to preload DLLs defined in the inherited global local environment variable PPSAPI_DLLS. The code contained within those libraries is then called from the NTPD service, usually running with elevated privileges. Depending on how securely the machine is setup and configured, if ntpd is configured to use the PPSAPI under Windows this can easily lead to a code injection.

Upstream bug:

http://support.ntp.org/bin/view/Main/NtpBug3384

References:

http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu
Comment 1 Andrej Nemec 2017-03-24 09:04:44 UTC 
Acknowledgments:

Name: the NTP project
Upstream: Cure53
Comment 2 Andrej Nemec 2017-03-24 09:05:41 UTC 
Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux.
Note You need to log in before you can comment on or make changes to this bug.