The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.

The remote host is running a version of macOS that is prior to 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Apache
 - AppSandbox
 - AppleScript
 - Application Firewall
 - ATS
 - Audio
 - CFNetwork
 - CFNetwork Proxies
 - CFString
 - Captive Network Assistant
 - CoreAudio
 - CoreText
 - DesktopServices
 - Directory Utility
 - file
 - Fonts
 - fsck_msdos
 - HFS
 - Heimdal
 - HelpViewer
 - IOFireWireFamily
 - ImageIO
 - Installer
 - Kernel
 - kext tools
 - libarchive
 - libc
 - libexpat
 - Mail
 - Mail Drafts
 - ntp
 - Open Scripting Architecture
 - PCRE
 - Postfix
 - Quick Look
 - QuickTime
 - Remote Management
 - SQLite
 - Sandbox
 - Screen Lock
 - Security
 - Spotlight
 - WebKit
 - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, 10.12.x prior to 10.12.6, or is not macOS 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - AppSandbox
  - AppleScript
  - Application Firewall
  - ATS
  - Audio
  - CFNetwork
  - CFNetwork Proxies
  - CFString
  - Captive Network Assistant
  - CoreAudio
  - CoreText
  - DesktopServices
  - Directory Utility
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - IOFireWireFamily
  - ImageIO
  - Installer
  - Kernel
  - kext tools
  - libarchive
  - libc
  - libexpat
  - Mail
  - Mail Drafts
  - ntp
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - SQLite
  - Sandbox
  - Screen Lock
  - Security
  - Spotlight
  - WebKit
  - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The version of the remote NTP server is 4.x prior to 4.2.8p10. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     receive() function within file ntpd/ntp_proto.c due to     the expected origin timestamp being cleared when a     packet with a zero origin timestamp is received. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted network packets, to reset the     expected origin timestamp for a target peer, resulting     in legitimate replies being dropped. (CVE-2016-9042)

  - An out-of-bounds write error exists in the mx4200_send()     function within file ntpd/refclock_mx4200.c due to     improper handling of the return value of the snprintf()     and vsnprintf() functions. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or possibly the execution of arbitrary code.
    However, neither the researcher nor vendor could find     any exploitable code path. (CVE-2017-6451)

  - A stack-based buffer overflow condition exists in the     addSourceToRegistry() function within file     ports/winnt/instsrv/instsrv.c due to improper validation     of certain input when adding registry keys. A local     attacker can exploit this to execute arbitrary code.
    (CVE-2017-6452)

  - A flaw exists due to dynamic link library (DLL) files     being preloaded when they are defined in the inherited     environment variable 'PPSAPI_DLLS'. A local attacker can     exploit this, via specially crafted DLL files, to     execute arbitrary code with elevated privileges.
    (CVE-2017-6455)

  - Multiple stack-based buffer overflow conditions exist in     various wrappers around the ctl_putdata() function     within file ntpd/ntp_control.c due to improper     validation of certain input from the ntp.conf file.
    An unauthenticated, remote attacker can exploit these,     by convincing a user into deploying a specially     crafted ntp.conf file, to cause a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2017-6458)

  - A flaw exists in the addKeysToRegistry() function within     file ports/winnt/instsrv/instsrv.c when running the     Windows installer due to improper termination of strings     used for adding registry keys, which may cause malformed     registry entries to be created. A local attacker can     exploit this issue to possibly disclose sensitive memory     contents. (CVE-2017-6459)

  - A stack-based buffer overflow condition exists in the     reslist() function within file ntpq/ntpq-subs.c when     handling server responses due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this, by convincing a user to connect to a     malicious NTP server and by using a specially crafted     server response, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-6460)

  - A stack-based buffer overflow condition exists in the     datum_pts_receive() function within file     ntpd/refclock_datum.c when handling handling packets     from the '/dev/datum' device due to improper validation     of certain input. A local attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-6462)

  - A denial of service vulnerability exists within file     ntpd/ntp_config.c when handling 'unpeer' configuration     options. An authenticated, remote attacker can exploit     this issue, via an 'unpeer' option value of '0', to     crash the ntpd daemon. (CVE-2017-6463)

  - A denial of service vulnerability exists when handling     configuration directives. An authenticated, remote     attacker can exploit this, via a malformed 'mode'     configuration directive, to crash the ntpd daemon.
    (CVE-2017-6464)

  - A flaw exists in the ntpq_stripquotes() function within     file ntpq/libntpq.c due to the function returning an     incorrect value. An unauthenticated, remote attacker can     possibly exploit this to have an unspecified impact.

  - An off-by-one overflow condition exists in the     oncore_receive() function in file ntpd/refclock_oncore.c     that possibly allows an unauthenticated, remote attacker     to have an unspecified impact.

  - A flaw exists due to certain code locations not invoking     the appropriate ereallocarray() and eallocarray()     functions. An unauthenticated, remote attacker can     possibly exploit this to have an unspecified impact.

  - A flaw exists due to the static inclusion of unused code     from the libisc, libevent, and libopts libraries. An     unauthenticated, remote attacker can possibly exploit     this to have an unspecified impact.

  - A security weakness exists in the Makefile due to a     failure to provide compile or link flags to offer     hardened security options by default.

ID	Name	Product	Family	Severity
700511	macOS < 10.13 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
103598	macOS < 10.13 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
99597	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2017-112-02)	Nessus	Slackware Local Security Checks	high
97988	Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p10 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2017-6459

medium

Tenable Plugins

critical

critical

high

high