Ubuntu update for ntp

Published: 2021-04-20

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-7182 CVE-2019-8936
CWE-ID	CWE-200 CWE-476
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software Subscribe	Ubuntu Operating systems & Components / Operating system sntp (Ubuntu package) Operating systems & Components / Operating system package or component ntpdate (Ubuntu package) Operating systems & Components / Operating system package or component ntp (Ubuntu package) Operating systems & Components / Operating system package or component
Vendor	Canonical Ltd.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU10798

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-7182

CWE-ID: CWE-200 - Information exposure

Exploit availability: Yes

Description

The vulnerability allows a remote unautheticated attacker to obtain potentially sensitive information.

The weakness exists due to insufficient validation user-supplied input. A remote attacker can submit a specially crafted mode 6 packet and gain access to potentially sensitive information.

Mitigation

Update the affected package ntp to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

sntp (Ubuntu package): before 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

ntpdate (Ubuntu package): before 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

ntp (Ubuntu package): before 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

External links

http://ubuntu.com/security/notices/USN-4563-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) NULL pointer dereference

EUVDB-ID: #VU20339

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8936

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error when processing authenticated mode 6 packets. A remote attacker can send malicious authenticated mode 6 (ntpq) packet from a permitted network address, trigger a NULL pointer dereference error and crash ntpd.

Mitigation

Update the affected package ntp to the latest version.

Vulnerable software versions

Ubuntu: 20.04 - 20.10

sntp (Ubuntu package): before 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

ntpdate (Ubuntu package): before 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

ntp (Ubuntu package): before 1:4.2.8p12+dfsg-3ubuntu4.20.10.1

External links

http://ubuntu.com/security/notices/USN-4563-2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.