Hi.
There is a security bug in 'xntp'.

This bug is public.

There is no coordinated release date (CRD) set.

CVE number: CVE-2009-1252
CVE description: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252


Original posting:



----- Forwarded message from CERT Coordination Center <cert@cert.org> -----

Date: Wed, 6 May 2009 18:14:44 -0400
To: SuSE Security Team <security@suse.de>
From: CERT Coordination Center <cert@cert.org>
Old-Content-Type: text/plain
Cc: CERT Coordination Center <cert@cert.org>
Subject: [security@suse.de] Vendor Notification VU#853097 - suse
Errors-To: security-bounces+thomas=suse.de@suse.de


Hello Folks,

We've been made aware of a vulnerability in NTP in configurations
where autokey is enabled.  We've been working with the reporter and
have not yet decided on a specific release date for the vulnerability.

Here is the original information that was provided about the bug:

-----

The bug affects ntp-stable (4.2.4 and perhaps before), and ntp-dev up to
ntp-4.2.5p74 (near as I can instantly recall).

The patch is to look for lines in ntpd/ntp_crypto.c of the form:

sprintf(statstr,

and replace them with:

snprintf(statstr, NTP_MAXSTRLEN,

So far, only systems that have enabled autokey are vulnerable.

Autokey is enabled if there is a line of the form:

crypto pw whatever

in the ntp.conf file.

-----


Here is a draft of the vulnerability from the reporter:

-----

2009-05-04: Remote exploit if autokey is enabled.

* References: [Sec 1151] CVE-2009-1252
* Affected Versions:
Vulnerability introduced in 4.1.70(?), on 2001-08-15, through:
4.2.4 before 4.2.4p7 (fixed 2009-05-04)
4.2.5 before 4.2.5p74 (fixed 2007-09-10)
* Summary: If autokey is enabled (the ntp.conf file contains the line
"crypto pw whatever" a remote attacker can send a carefully crafted
packet that can overflow a stack buffer and potentially allow for
malicious code to be executed with the privilege level of the ntpd
process.
* Mitigation:
* Upgrade to 4.2.4p7 or 4.2.5p74, or later:

Get releases containing the fix from http://support.ntp.org/download

* Otherwise, be sure you are *not* enabling autokey - remove
'crypto pw whatever' from your ntp.conf file
* Credit: This vulnerability was discovered by Chis Ries of CMU.

When the NTP Project learned about this vulnerability and had implemented
a fix, the first people we notified were Premium Members of the NTP Forum
(http://ntpforum.isc.org).  CERT (http://cert.org) was notified next, and
we all agreed on the release date for the public announcement and the fix.


* [Sec 1144] limited (two byte) buffer overflow in ntpq.  CVE-2009-0159
Credit for finding this vulnerability goes to Geoff Keating of Apple.

* [Sec 1149] use SO_EXCLUSIVEADDRUSE on Windows
Credit for finding this issue goes to Dave Hart.

THIS IS A STRONGLY RECOMMENDED UPGRADE.


-----


The reporter has indicated that 4.2.4p7-RC5 currently contains the
fix, and that this version will be the same as the release version,
aside from the version number.  What's not clear at this point is when
p7 may officially be released, along with the vulnerability details.

Once we determine this timing, we'll send out another email with those
details.  We're sending out this message just to make sure that nobody
is caught offguard.


Thank you,
   Will Dormann

=============================
Vulnerability Analyst
CERT Coordination Center
4500 Fifth Ave.
Pittsburgh, PA 15213
1-412-268-7090
=============================




----- End forwarded message -----