Detections
Analytics

AIX NTP v3 Advisory : ntp_advisory9.asc (IV96305) (IV96306) (IV96307) (IV96308) (IV96309) (IV96310)

high Nessus Plugin ID 102130

Language:

Synopsis

The remote AIX host has a version of NTP installed that is affected by multiple vulnerabilities.

Description

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

 - An out-of-bounds write error exists in the mx4200_send() function within file ntpd/refclock_mx4200.c due to improper handling of the return value of the snprintf() and vsnprintf() functions. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or possibly the execution of arbitrary code.
 However, neither the researcher nor vendor could find any exploitable code path. (CVE-2017-6451)

 - Multiple stack-based buffer overflow conditions exist in various wrappers around the ctl_putdata() function within file ntpd/ntp_control.c due to improper validation of certain input from the ntp.conf file.
 An unauthenticated, remote attacker can exploit these, by convincing a user into deploying a specially crafted ntp.conf file, to cause a denial of service condition or possibly the execution of arbitrary code.
 (CVE-2017-6458)

 - A stack-based buffer overflow condition exists in the datum_pts_receive() function within file ntpd/refclock_datum.c when handling handling packets from the '/dev/datum' device due to improper validation of certain input. A local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-6462)

 - A denial of service vulnerability exists when handling configuration directives. An authenticated, remote attacker can exploit this, via a malformed 'mode' configuration directive, to crash the ntpd daemon.
 (CVE-2017-6464)

Solution

A fix is available and can be downloaded from the IBM AIX website.

See Also

https://aix.software.ibm.com/aix/efixes/security/ntp_advisory9.asc

Plugin Details

Severity: High

ID: 102130

File Name: aix_ntp_v3_advisory9.nasl

Version: 3.12

Type: local

Published: 8/3/2017

Updated: 4/21/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:ibm:aix, cpe:/a:ntp:ntp

Required KB Items: Host/AIX/lslpp, Host/local_checks_enabled, Host/AIX/version

Patch Publication Date: 7/6/2017

Vulnerability Publication Date: 2/11/2017

Reference Information

CVE: CVE-2017-6451, CVE-2017-6458, CVE-2017-6462, CVE-2017-6464

BID: 97045, 97050, 97051, 97058

CERT: 325339