NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.

The remote host is running a version of macOS that is prior to 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Apache
 - AppSandbox
 - AppleScript
 - Application Firewall
 - ATS
 - Audio
 - CFNetwork
 - CFNetwork Proxies
 - CFString
 - Captive Network Assistant
 - CoreAudio
 - CoreText
 - DesktopServices
 - Directory Utility
 - file
 - Fonts
 - fsck_msdos
 - HFS
 - Heimdal
 - HelpViewer
 - IOFireWireFamily
 - ImageIO
 - Installer
 - Kernel
 - kext tools
 - libarchive
 - libc
 - libexpat
 - Mail
 - Mail Drafts
 - ntp
 - Open Scripting Architecture
 - PCRE
 - Postfix
 - Quick Look
 - QuickTime
 - Remote Management
 - SQLite
 - Sandbox
 - Screen Lock
 - Security
 - Spotlight
 - WebKit
 - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

An update of the ntp package has been released.

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, 10.12.x prior to 10.12.6, or is not macOS 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - AppSandbox
  - AppleScript
  - Application Firewall
  - ATS
  - Audio
  - CFNetwork
  - CFNetwork Proxies
  - CFString
  - Captive Network Assistant
  - CoreAudio
  - CoreText
  - DesktopServices
  - Directory Utility
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - IOFireWireFamily
  - ImageIO
  - Installer
  - Kernel
  - kext tools
  - libarchive
  - libc
  - libexpat
  - Mail
  - Mail Drafts
  - ntp
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - SQLite
  - Sandbox
  - Screen Lock
  - Security
  - Spotlight
  - WebKit
  - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The version of the remote NTP server is 4.x prior to 4.2.8p10. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     receive() function within file ntpd/ntp_proto.c due to     the expected origin timestamp being cleared when a     packet with a zero origin timestamp is received. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted network packets, to reset the     expected origin timestamp for a target peer, resulting     in legitimate replies being dropped. (CVE-2016-9042)

  - An out-of-bounds write error exists in the mx4200_send()     function within file ntpd/refclock_mx4200.c due to     improper handling of the return value of the snprintf()     and vsnprintf() functions. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or possibly the execution of arbitrary code.
    However, neither the researcher nor vendor could find     any exploitable code path. (CVE-2017-6451)

  - A stack-based buffer overflow condition exists in the     addSourceToRegistry() function within file     ports/winnt/instsrv/instsrv.c due to improper validation     of certain input when adding registry keys. A local     attacker can exploit this to execute arbitrary code.
    (CVE-2017-6452)

  - A flaw exists due to dynamic link library (DLL) files     being preloaded when they are defined in the inherited     environment variable 'PPSAPI_DLLS'. A local attacker can     exploit this, via specially crafted DLL files, to     execute arbitrary code with elevated privileges.
    (CVE-2017-6455)

  - Multiple stack-based buffer overflow conditions exist in     various wrappers around the ctl_putdata() function     within file ntpd/ntp_control.c due to improper     validation of certain input from the ntp.conf file.
    An unauthenticated, remote attacker can exploit these,     by convincing a user into deploying a specially     crafted ntp.conf file, to cause a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2017-6458)

  - A flaw exists in the addKeysToRegistry() function within     file ports/winnt/instsrv/instsrv.c when running the     Windows installer due to improper termination of strings     used for adding registry keys, which may cause malformed     registry entries to be created. A local attacker can     exploit this issue to possibly disclose sensitive memory     contents. (CVE-2017-6459)

  - A stack-based buffer overflow condition exists in the     reslist() function within file ntpq/ntpq-subs.c when     handling server responses due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this, by convincing a user to connect to a     malicious NTP server and by using a specially crafted     server response, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-6460)

  - A stack-based buffer overflow condition exists in the     datum_pts_receive() function within file     ntpd/refclock_datum.c when handling handling packets     from the '/dev/datum' device due to improper validation     of certain input. A local attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-6462)

  - A denial of service vulnerability exists within file     ntpd/ntp_config.c when handling 'unpeer' configuration     options. An authenticated, remote attacker can exploit     this issue, via an 'unpeer' option value of '0', to     crash the ntpd daemon. (CVE-2017-6463)

  - A denial of service vulnerability exists when handling     configuration directives. An authenticated, remote     attacker can exploit this, via a malformed 'mode'     configuration directive, to crash the ntpd daemon.
    (CVE-2017-6464)

  - A flaw exists in the ntpq_stripquotes() function within     file ntpq/libntpq.c due to the function returning an     incorrect value. An unauthenticated, remote attacker can     possibly exploit this to have an unspecified impact.

  - An off-by-one overflow condition exists in the     oncore_receive() function in file ntpd/refclock_oncore.c     that possibly allows an unauthenticated, remote attacker     to have an unspecified impact.

  - A flaw exists due to certain code locations not invoking     the appropriate ereallocarray() and eallocarray()     functions. An unauthenticated, remote attacker can     possibly exploit this to have an unspecified impact.

  - A flaw exists due to the static inclusion of unused code     from the libisc, libevent, and libopts libraries. An     unauthenticated, remote attacker can possibly exploit     this to have an unspecified impact.

  - A security weakness exists in the Makefile due to a     failure to provide compile or link flags to offer     hardened security options by default.

ID	Name	Product	Family	Severity
700511	macOS < 10.13 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
121678	Photon OS 1.0: Ntp PHSA-2017-0010	Nessus	PhotonOS Local Security Checks	high
103598	macOS < 10.13 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
99597	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2017-112-02)	Nessus	Slackware Local Security Checks	high
97988	Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p10 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2017-6455

high

Tenable Plugins

critical

high

critical

high

high