Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.

Przemyslaw Frasunek <venglin@FREEBSD.LUBLIN.PL> reported that ntp daemons such as ntp and xntp3 are vulnerable to a buffer overflow that can lead to a remote root exploit. Linux-Mandrake users are urged to upgrade ntp and xntp3 immediately.

Network Time Protocol (NTP) is used to synchronize time on multiple devices. A vulnerability has been discovered in the NTP daemon query processing functionality. This vulnerability has been publicly announced. 

Other Cisco software applications may run on Solaris platforms and where those products have not specifically been identified, customers should install security patches regularly in accordance with their normal maintenance procedures. Cisco is continuing to research this issue in other products that may be affected. Unless explicitly stated otherwise, all other products are considered to be unaffected. There are workarounds available to mitigate the effects.

Przemyslaw Frasunek <venglin@FREEBSD.LUBLIN.PL> reported that ntp daemons such as that released with Debian GNU/Linux are vulnerable to a buffer overflow that can lead to a remote root exploit. A previous advisory (DSA-045-1) partially addressed this issue, but introduced a potential denial of service attack. This has been corrected for Debian 2.2 (potato) in ntp version 4.0.99g-2potato2.

By sending a crafted NTP control packet, it is possible to trigger a buffer overflow in the NTP daemon.  This vulnerability can be exploited remotely.  The successful exploitation may cause arbitrary code to be executed on the target machine. 

This vulnerability is documented as Cisco Bug ID CSCdt93866. 

An attacker may use this flaw to execute arbitrary code on the remote host (although it's not believed to be doable)

The remote NTP server is affected by a buffer overflow condition due to improper bounds checking on the 'readvar' argument. An unauthenticated, remote attacker can exploit this, via a specially crafted request that uses an overly long argument, to execute arbitrary code with root privileges.

ID	Name	Product	Family	Severity
61909	Mandrake Linux Security Advisory : ntp (MDKSA-2001:036)	Nessus	Mandriva Local Security Checks	critical
48965	NTP Vulnerability - Cisco Systems	Nessus	CISCO	critical
14882	Debian DSA-045-2 : ntpd - remote root exploit	Nessus	Debian Local Security Checks	critical
10982	Cisco NTP ntpd readvar Variable Remote Overflow (CSCdt93866)	Nessus	CISCO	critical
10647	Network Time Protocol Daemon (ntpd) readvar Variable Overflow RCE	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2001-0414

critical

Tenable Plugins

critical

critical

critical

critical

critical