mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

An update of the ntp package has been released.

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: denial of service by trigerring rate limiting on NTP server (CVE-2015-7705)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

  - ntpd in ntp before 4.2.8p3 with remote configuration enabled allows remote authenticated users with     knowledge of the configuration password and access to a computer entrusted to perform remote configuration     to cause a denial of service (service crash) via a NULL byte in a crafted configuration directive packet.
    (CVE-2015-5146)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

  - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

  - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

  - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of ntp installed on the remote host is prior to 4.2.8p15-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2396 advisory.

    2024-02-15: CVE-2023-26555 was added to this advisory.

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop.
    (CVE-2023-26551)

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point.
    (CVE-2023-26552)

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    (CVE-2023-26553)

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character.
    (CVE-2023-26554)

    praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ntp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

  - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of ntp installed on the remote host is prior to 4.2.8p16. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-153-02 advisory.

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

  - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2171-1 advisory.

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2142-1 advisory.

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
204521	Photon OS 4.0: Ntp PHSA-2023-4.0-0417	Nessus	PhotonOS Local Security Checks	medium
204164	Photon OS 5.0: Ntp PHSA-2023-5.0-0040	Nessus	PhotonOS Local Security Checks	medium
204000	Photon OS 3.0: Ntp PHSA-2023-3.0-0606	Nessus	PhotonOS Local Security Checks	medium
502319	Siemens SITOP UPS1600 Out-of-bounds Write (CVE-2023-26553)	Tenable OT Security	Tenable.ot	medium
198521	RHEL 7 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196526	RHEL 6 : ntp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
189034	EulerOS 2.0 SP11 : ntp (EulerOS-SA-2023-2700)	Nessus	Huawei Local Security Checks	medium
189023	EulerOS Virtualization 2.9.0 : ntp (EulerOS-SA-2023-2990)	Nessus	Huawei Local Security Checks	medium
189012	EulerOS Virtualization 2.11.1 : ntp (EulerOS-SA-2023-2734)	Nessus	Huawei Local Security Checks	medium
188979	EulerOS 2.0 SP11 : ntp (EulerOS-SA-2023-2658)	Nessus	Huawei Local Security Checks	medium
188952	EulerOS Virtualization 2.11.0 : ntp (EulerOS-SA-2023-2765)	Nessus	Huawei Local Security Checks	medium
188716	EulerOS Virtualization 2.9.1 : ntp (EulerOS-SA-2023-2964)	Nessus	Huawei Local Security Checks	medium
187833	Amazon Linux 2 : ntp (ALAS-2024-2396)	Nessus	Amazon Linux Local Security Checks	medium
179534	EulerOS 2.0 SP9 : ntp (EulerOS-SA-2023-2621)	Nessus	Huawei Local Security Checks	medium
179529	EulerOS 2.0 SP9 : ntp (EulerOS-SA-2023-2591)	Nessus	Huawei Local Security Checks	medium
179287	EulerOS Virtualization 2.10.0 : ntp (EulerOS-SA-2023-2565)	Nessus	Huawei Local Security Checks	medium
179265	EulerOS Virtualization 2.10.1 : ntp (EulerOS-SA-2023-2546)	Nessus	Huawei Local Security Checks	medium
178363	EulerOS 2.0 SP10 : ntp (EulerOS-SA-2023-2363)	Nessus	Huawei Local Security Checks	medium
178362	EulerOS 2.0 SP10 : ntp (EulerOS-SA-2023-2389)	Nessus	Huawei Local Security Checks	medium
176640	Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current ntp Multiple Vulnerabilities (SSA:2023-153-02)	Nessus	Slackware Local Security Checks	medium
175587	SUSE SLES12 Security Update : ntp (SUSE-SU-2023:2171-1)	Nessus	SuSE Local Security Checks	medium
175541	SUSE SLES15 / openSUSE 15 Security Update : ntp (SUSE-SU-2023:2142-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-26553

medium

Tenable Plugins

medium

medium

medium

medium

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium