Bug 1435565 – CVE-2017-6459 ntp: Data Structure terminated insufficiently

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1435565 - (CVE-2017-6459) CVE-2017-6459 ntp: Data Structure terminated insufficiently

Summary:	CVE-2017-6459 ntp: Data Structure terminated insufficiently

Status:	CLOSED NOTABUG

Aliases:	CVE-2017-6459

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20170321,reported=2...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2017-03-24 05:02 EDT by Andrej Nemec
Modified:	2017-03-24 05:05 EDT (History)
CC List:	2 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-03-24 05:05:52 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2017-03-24 05:02:36 EDT

The Windows installer for NTP calls strcpy() with an argument that specifically contains multiple null bytes. strcpy() only copies a single terminating null character into the target buffer instead of copying the required double null bytes in the addKeysToRegistry() function. As a consequence, a garbage registry entry can be created. The additional arsize parameter is erroneously set to contain two null bytes and the following call to RegSetValueEx() claims to be passing in a multi-string value, though this may not be true.

Upstream bug:

http://support.ntp.org/bin/view/Main/NtpBug3382

References:

http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu

Comment 1 Andrej Nemec 2017-03-24 05:04:52 EDT

Acknowledgments:

Name: the NTP project
Upstream: Cure53

Comment 2 Andrej Nemec 2017-03-24 05:05:52 EDT

Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux.

Note You need to log in before you can comment on or make changes to this bug.