AIX NTP v3 Advisory : ntp_advisory9.asc (IV96305) (IV96306) (IV96307) (IV96308) (IV96309) (IV96310)

This script is Copyright (C) 2017 Tenable Network Security, Inc.


Synopsis :

The remote AIX host has a version of NTP installed that is affected
by multiple vulnerabilities.

Description :

The version of NTP installed on the remote AIX host is affected by
the following vulnerabilities :

- An out-of-bounds write error exists in the mx4200_send()
function within file ntpd/refclock_mx4200.c due to
improper handling of the return value of the snprintf()
and vsnprintf() functions. An unauthenticated, remote
attacker can exploit this to cause a denial of service
condition or possibly the execution of arbitrary code.
However, neither the researcher nor vendor could find
any exploitable code path. (CVE-2017-6451)

- Multiple stack-based buffer overflow conditions exist in
various wrappers around the ctl_putdata() function
within file ntpd/ntp_control.c due to improper
validation of certain input from the ntp.conf file.
An unauthenticated, remote attacker can exploit these,
by convincing a user into deploying a specially
crafted ntp.conf file, to cause a denial of service
condition or possibly the execution of arbitrary code.
(CVE-2017-6458)

- A stack-based buffer overflow condition exists in the
datum_pts_receive() function within file
ntpd/refclock_datum.c when handling handling packets
from the '/dev/datum' device due to improper validation
of certain input. A local attacker can exploit this to
cause a denial of service condition or the execution of
arbitrary code. (CVE-2017-6462)

- A denial of service vulnerability exists when handling
configuration directives. An authenticated, remote
attacker can exploit this, via a malformed 'mode'
configuration directive, to crash the ntpd daemon.
(CVE-2017-6464)

See also :

http://aix.software.ibm.com/aix/efixes/security/ntp_advisory9.asc

Solution :

A fix is available and can be downloaded from the IBM AIX website.

Risk factor :

Medium / CVSS Base Score : 6.5
(CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P)
CVSS Temporal Score : 5.4
(CVSS2#E:F/RL:OF/RC:ND)
Public Exploit Available : true

Family: AIX Local Security Checks

Nessus Plugin ID: 102130 ()

Bugtraq ID: 97045
97050
97051
97058

CVE ID: CVE-2017-6451
CVE-2017-6458
CVE-2017-6462
CVE-2017-6464

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now