The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended.

Updated ntp packages that fix several bugs are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

The Network Time Protocol (NTP) is used to synchronize a computer's time with a reference time source.

The NTP daemon (ntpd), when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes ntpd to run with different privileges than intended. (CVE-2005-2496)

The following issues have also been addressed in this update: - The init script had several problems - The script executed on upgrade could fail - The man page for ntpd indicated the wrong option for specifying a chroot directory - The ntp daemon could crash with the message 'Exiting: No more memory!' - There is a new option for syncing the hardware clock after a successful run of ntpdate

Users of ntp should upgrade to these updated packages, which resolve these issues.

Thomas Biege discovered a flaw in the privilege dropping of the NTP server. When ntpd was configured to drop root privileges, and the group to run under was specified as a name (as opposed to a numeric group ID), ntpd changed to the wrong group. Depending on the actual group it changed to, this could either cause non-minimal privileges, or a malfunctioning ntp server if the group does not have the privileges that ntpd actually needs.

On Ubuntu 4.10, ntpd does not use privilege dropping by default, so you are only affected if you manually activated it. In Ubuntu 5.04, privilege dropping is used by default, but this bug is already fixed.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

When starting xntpd with the -u option and specifying the group by using a string not a numeric gid the daemon uses the gid of the user not the group. This problem is now fixed by this update.

The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2496 to this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SuSE developers discovered that ntp confuses the given group id with the group id of the given user when called with a group id on the commandline that is specified as a string and not as a numeric gid, which causes ntpd to run with different privileges than intended.

According to its version number, the NTP (Network Time Protocol) server running on the remote host is affected by a flaw that causes it to run with the permissions of a privileged user if a group name rather than a group ID is specified on the command line. A local attacker, who has managed to compromise the application through some other means, can exploit this issue to gain elevated privileges.

ID	Name	Product	Family	Severity
22275	CentOS 4 : ntp (CESA-2006:0393)	Nessus	CentOS Local Security Checks	medium
22220	RHEL 4 : ntp (RHSA-2006:0393)	Nessus	Red Hat Local Security Checks	medium
20585	Ubuntu 4.10 : ntp vulnerability (USN-175-1)	Nessus	Ubuntu Local Security Checks	medium
19720	Fedora Core 3 : ntp-4.2.0.a.20040617-5.FC3 (2005-812)	Nessus	Fedora Local Security Checks	medium
19571	Debian DSA-801-1 : ntp - programming error	Nessus	Debian Local Security Checks	medium
19517	Network Time Protocol Daemon (ntpd) < 4.2.1 -u Group Permission Weakness Privilege Escalation	Nessus	Misc.	high

Detections

Analytics

CVE-2005-2496

critical

Tenable Plugins

medium

medium

medium

medium

medium

high