Out-of-bounds write in ntp - CVE-2023-26554

Vulnerability identifier: #VU76001

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26554

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within mstolfp in libntp/mstolfp.c. A remote attacker with control over a malicious NTP server can trick the victim into connecting to it, trigger an out-of-bounds write and execute arbitrary code on the target system via the client ntpq process.

ntp
IBM Cloud Object Storage Systems
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Slackware Linux
Legacy Module
openSUSE Leap
openEuler
Junos OS
Junos OS Evolved
LANTIME Operating System Firmware (LTOS)
SITOP UPS1600 10 A Ethernet/ PROFINET
SITOP UPS1600 20 A Ethernet/ PROFINET
SITOP UPS1600 40 A Ethernet/ PROFINET
SITOP UPS1600 EX 20 A Ethernet PROFINET
HP-UX NTP
net-misc/ntp
ntp-perl
ntp-help
ntp-debuginfo
ntp-debugsource
ntp
ntp-doc
IBM Integrated Analytics System
RecoverPoint for VMs
Dell EMC NetWorker vProxy

Install updates from vendor's website.

IBM Cloud Object Storage Systems - addressed in versions 3.19.0.40, 3.19.1.36
LANTIME Operating System Firmware (LTOS) - update to 7.06.014
Junos OS - addressed in versions 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.2R1
Junos OS Evolved - addressed in versions 20.4R3-S8-EVO, 21.2R3-S6-EVO, 21.3R3-S5-EVO, 21.4R3-S4-EVO, 22.1R3-S3-EVO, 22.2R3-S2-EVO, 22.3R2-S2-EVO, 22.3R3-S1-EVO, 22.4R2-S1-EVO, 22.4R3-EVO, 23.2R1-EVO
HP-UX NTP - update to C.4.2.8.7.0
IBM Integrated Analytics System - update to 1.0.30.0
SITOP UPS1600 10 A Ethernet/ PROFINET - update to 2.5.4
SITOP UPS1600 20 A Ethernet/ PROFINET - update to 2.5.4
SITOP UPS1600 40 A Ethernet/ PROFINET - update to 2.5.4
SITOP UPS1600 EX 20 A Ethernet PROFINET - update to 2.5.4
net-misc/ntp - update to 4.2.8
ntp-perl - update to 4.2.8p14-7
ntp-help - update to 4.2.8p14-7
ntp-debuginfo - update to 4.2.8p14-7
ntp-debugsource - update to 4.2.8p14-7
ntp - update to 4.2.8p14-7
ntp - addressed in versions 4.2.8p15-100.1, 4.2.8p15-150000.4.22.1
ntp-debuginfo - addressed in versions 4.2.8p15-100.1, 4.2.8p15-150000.4.22.1
ntp-doc - addressed in versions 4.2.8p15-100.1, 4.2.8p15-150000.4.22.1
ntp-debugsource - addressed in versions 4.2.8p15-100.1, 4.2.8p15-150000.4.22.1
ntp - update to 4.2.8p16
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC NetWorker vProxy - addressed in versions 19.8.0.3, 19.9.0.2

• https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554
• https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321

• Multiple vulnerabilities in ntp
• SUSE update for ntp
• SUSE update for ntp
• Slackware Linux update for ntp
• Junos OS and Junos OS Evolved update for NTP
• Multiple vulnerabilities in Dell NetWorker vProxy
• openEuler update for ntp
• Multiple vulnerabilities in Siemens SITOP UPS1600
• IBM Integrated Analytics System update for Network Time Protocol (NTP)
• Denial of service in HP-UX NTP
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Multiple vulnerabilities in IBM Cloud Object System
• Meinberg LANTIME firmware update for third-party components (May 2023)
• Gentoo update for NTP