[ntp:security] [scr465532] four CVEs

Harlan Stenn stenn at nwtime.org
Wed Feb 21 00:14:50 UTC 2018


Thanks a bunch!

H

On 2/20/18 4:12 PM, cve-request at mitre.org wrote:
> (This message was previously sent to security at ntp.org at 1517 UTC
> on 2018-02-16.)
> 
> The four additional CVE IDs are below. We had previously sent
> CVE-2018-7170 to Harlan Stenn for a fifth issue and he asked how to
> edit it. It is not necessary to edit it at this time. We will obtain
> the details from http://support.ntp.org/bin/view/Main/SecurityNotice
> after the vulnerability becomes public.
> 
> 
>> [Vulnerability Type]
>> Buffer Overflow
> 
>> ------------------------------------------
> 
>> [Vendor of Product]
>> Network Time Foundation
> 
>> ------------------------------------------
> 
>> [Affected Product Code Base]
>> NTP - ntp-4.2.8p6 - ntp-4.2.8p10
> 
>> ------------------------------------------
> 
>> [Reference]
>> http://bugs.ntp.org/3412
> 
>> ------------------------------------------
> 
>> [Has vendor confirmed or acknowledged the vulnerability?]
>> true
> 
>> ------------------------------------------
> 
>> [Discoverer]
>> Yihan Lian of Qihoo 360
> 
> Use CVE-2018-7182.
> 
> 
>> [Vulnerability Type]
>> Buffer Overflow
> 
>> ------------------------------------------
> 
>> [Vendor of Product]
>> Network Time Foundation
> 
>> ------------------------------------------
> 
>> [Affected Product Code Base]
>> ntpq - ntp-4.2.8p6 - ntp-4.2.8p10.  Fixed in ntp-4.2.8p11
> 
>> ------------------------------------------
> 
>> [Affected Component]
>> ntpq's decodarr() function
> 
>> ------------------------------------------
> 
>> [Reference]
>> http://bugs.ntp.org/3414
> 
>> ------------------------------------------
> 
>> [Has vendor confirmed or acknowledged the vulnerability?]
>> true
> 
>> ------------------------------------------
> 
>> [Discoverer]
>> Michael Macnair of Thales e-Security
> 
> Use CVE-2018-7183.
> 
> 
>> [VulnerabilityType Other]
>> Disruption of symmetric interleaved mode
> 
>> ------------------------------------------
> 
>> [Vendor of Product]
>> Network Time Foundation
> 
>> ------------------------------------------
> 
>> [Affected Product Code Base]
>> NTP - ntp-4.2.8p4 - 4.2.8p10.  Fixed in ntp-4.2.8p11
> 
>> ------------------------------------------
> 
>> [Affected Component]
>> ntpd
> 
>> ------------------------------------------
> 
>> [Reference]
>> http://bugs.ntp.org/3453
> 
>> ------------------------------------------
> 
>> [Has vendor confirmed or acknowledged the vulnerability?]
>> true
> 
>> ------------------------------------------
> 
>> [Discoverer]
>> Miroslav Lichvar of Red Hat
> 
> Use CVE-2018-7184.
> 
> 
>> [VulnerabilityType Other]
>> Disruption of symmetric peer association
> 
>> ------------------------------------------
> 
>> [Vendor of Product]
>> Network Time Foundation
> 
>> ------------------------------------------
> 
>> [Affected Product Code Base]
>> ntpd - ntp-4.2.8p4 - 4.2.8p10.  Fixed in ntp-4.2.8p11
> 
>> ------------------------------------------
> 
>> [Affected Component]
>> ntpd
> 
>> ------------------------------------------
> 
>> [Attack Type Other]
>> Protocol disruption
> 
>> ------------------------------------------
> 
>> [Impact Denial of Service]
>> true
> 
>> ------------------------------------------
> 
>> [Reference]
>> http://bugs.ntp.org/3454
> 
>> ------------------------------------------
> 
>> [Has vendor confirmed or acknowledged the vulnerability?]
>> true
> 
>> ------------------------------------------
> 
>> [Discoverer]
>> Miroslav Lichvar of Red Hat
> 
> Use CVE-2018-7185.
> 
> 
> 

-- 
Harlan Stenn <stenn at nwtime.org>
http://networktimefoundation.org - be a member!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 699 bytes
Desc: OpenPGP digital signature
URL: <http://lists.ntp.org/private/security/attachments/20180221/f11ef52c/attachment.sig>


More information about the security mailing list