NTP BUG 3379: Potential Overflows in ctl_put() functions

Last update: June 27, 2022 20:45 UTC (51d68a4aa)

---

Summary

Resolved	Potential Overflows in ctl_put() functions	21 Mar 2017
References	Bug 3379	CVE-2017-6458
Affects	All versions of NTP, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94.	Resolved in 4.2.8p10.
CVSS2 Score	MED 4.6	AV:N/AC:H/Au:M/C:N/I:N/A:C)
CVSS3 Score	MED 4.2	CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

---

Description

ntpd makes use of different wrappers around ctl_putdata() to create name/value ntpq (mode 6) response strings. For example, ctl_putstr() is usually used to send string data (variable names or string data). The formatting code was missing a length check for variable names. If somebody explicitly created any unusually long variable names in ntpd (longer than 200-512 bytes, depending on the type of variable), then if any of these variables are added to the response list it would overflow a buffer.

---

Mitigation

• Implement BCP-38.
• Upgrade to 4.2.8p10 or later.
• If you don’t want to upgrade, then don’t setvar variable names longer than 200-512 bytes in your ntp.conf file.
• Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.

---

Credit

This weakness was discovered by Cure53.

---

Timeline

• 2017 Mar 21: Public release
• 2017 Mar 06: Early Access Program Release: Premier and Partner Institutional Members
• 2017 Mar 06: Notification to Institutional Members
• 2017 Feb 09: Mozilla/Cure53 audit received