NTP BUG 3808: ntpq will abort with an assertion failure if given a malformed RT-11 date
Last update: June 1, 2023 11:28 UTC (d2a7faef2)
||30 May 2023
ntpq from ntp-4.2.6 up to, but not including ntp-4.2.8p16.
|Resolved in 4.2.8p16.
||Unsure - this vulnerability requires conditions that do not seem to exist.
Ancient versions of NTP (pre-dating ntp3, which first came out in June of 1993) used an RT-11 date format for certain limited purposes. This date format hasn’t been used in 30 years' time. If
ntpq were to receive an RT-11 date format with out-of-range values (which has never been reported), then
ntpq would abort with an assertion failure.
Reported by Miroslav Lichvar.