what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

FreeBSD Security Advisory - NTP Weak Seeding / Buffer Overflow

Posted Dec 24, 2014

Site security.freebsd.org

FreeBSD Security Advisory - The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP) used to synchronize the time of a computer system to a reference time source. When no authentication key is set in the configuration file, ntpd(8) would generate a random key that uses a non-linear additive feedback random number generator seeded with very few bits of entropy. The ntp-keygen(8) utility is also affected by a similar issue. When Autokey Authentication is enabled, for example if ntp.conf(5) contains a 'crypto pw' directive, a remote attacker can send a carefully crafted packet that can overflow a stack buffer. In ntp_proto.c, the receive() function is missing a return statement in the case when an error is detected.

tags | advisory, remote, overflow, cryptography, protocol

systems | freebsd

advisories | CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296

SHA-256 | 7d0a12f077a570a47b07177a5a88f387e10ed75041b9b627e36f0897b24db3e6

Download | Favorite | View

Related Files

No related files