Out-of-bounds write in ntp - CVE-2023-26555

Vulnerability identifier: #VU76002

CSH Severity: Low

CVSS v4: 5.4 [CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-26555

CWE-ID: CWE-787

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows an attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within praecis_parse() function in ntpd/refclock_palisade.c. An attacker with physical proximity to device can trigger an out-of-bounds write error by manipulating the GPS receiver and execute arbitrary code on the target system.

ntp
Dell EMC PowerProtect Data Protection
Dell Data Protection Central
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Slackware Linux
Legacy Module
openSUSE Leap
openEuler
Junos OS
Junos OS Evolved
Fedora
LANTIME Operating System Firmware (LTOS)
Oracle Communications Session Border Controller
HP-UX NTP
ntp-refclock
net-misc/ntp
ntp-perl
ntp-help
ntp-debuginfo
ntp-debugsource
ntp
ntp-doc
Dell EMC Storage Monitoring and Reporting (SMR)
EMC ViPR SRM
RecoverPoint for VMs
Dell EMC VxRail Appliance

Install updates from vendor's website.

LANTIME Operating System Firmware (LTOS) - update to 7.06.014
Junos OS - addressed in versions 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.2R1
Junos OS Evolved - addressed in versions 20.4R3-S8-EVO, 21.2R3-S6-EVO, 21.3R3-S5-EVO, 21.4R3-S4-EVO, 22.1R3-S3-EVO, 22.2R3-S2-EVO, 22.3R2-S2-EVO, 22.3R3-S1-EVO, 22.4R2-S1-EVO, 22.4R3-EVO, 23.2R1-EVO
HP-UX NTP - update to C.4.2.8.7.0
ntp-refclock - addressed in versions 0.6-1.fc37, 0.6-1.fc38
net-misc/ntp - update to 4.2.8
ntp-perl - update to 4.2.8p14-8
ntp-help - update to 4.2.8p14-8
ntp-debuginfo - update to 4.2.8p14-8
ntp-debugsource - update to 4.2.8p14-8
ntp - update to 4.2.8p14-8
ntp - update to 4.2.8p16
ntp - addressed in versions 4.2.8p17-103.1, 4.2.8p17-150000.4.25.1
ntp-debugsource - addressed in versions 4.2.8p17-103.1, 4.2.8p17-150000.4.25.1
ntp-debuginfo - addressed in versions 4.2.8p17-103.1, 4.2.8p17-150000.4.25.1
ntp-doc - addressed in versions 4.2.8p17-103.1, 4.2.8p17-150000.4.25.1
Dell EMC Storage Monitoring and Reporting (SMR) - update to 4.10.0.0
EMC ViPR SRM - update to 4.10.0.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Dell EMC VxRail Appliance - update to 8.0.120

• https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26555
• https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506546409

• Multiple vulnerabilities in ntp
• Slackware Linux update for ntp
• SUSE update for ntp
• SUSE update for ntp
• Fedora 38 update for ntp-refclock
• Fedora 37 update for ntp-refclock
• Multiple vulnerabilities in Dell Data Protection Central
• Junos OS and Junos OS Evolved update for NTP
• openEuler update for ntp
• Multiple vulnerabilities in Dell EMC VxRail Appliance
• Denial of service in HP-UX NTP
• Multiple vulnerabilities in Dell RecoverPoint for Virtual Machines
• Meinberg LANTIME firmware update for third-party components (May 2023)
• Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
• Gentoo update for NTP
• Multiple vulnerabilities in Oracle Communications Session Border Controller