Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 675538 (CVE-2019-6442, CVE-2019-6443, CVE-2019-6444, CVE-2019-6445) - <net-misc/ntpsec-1.1.3: multiple vulnerabilities (CVE-2019-{6442,6443,6444,6445})
Summary: <net-misc/ntpsec-1.1.3: multiple vulnerabilities (CVE-2019-{6442,6443,6444,64...
Status: RESOLVED FIXED
Alias: CVE-2019-6442, CVE-2019-6443, CVE-2019-6444, CVE-2019-6445
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~2 [noglsa cve]
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-15 19:15 UTC by James Browning
Modified: 2020-04-17 05:17 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description James Browning 2019-01-15 19:15:30 UTC 
version 1.1.3 was released on January 13th and fixes several issues.
Comment 1 Gary E. Miller 2019-01-17 00:11:06 UTC 
Fixes 4 CVE:

CVE-2019-6443
CVE-2019-6444
CVE-2019-6445
CVE-2019-6442
Comment 2 Agostino Sarubbo gentoo-dev 2019-05-22 11:23:32 UTC 
This is a security bug
Comment 3 D'juan McDonald (domhnall) 2019-05-23 04:56:51 UTC 
(https://nvd.nist.gov/vuln/detail/CVE-2019-6445):
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.

(https://nvd.nist.gov/vuln/detail/CVE-2019-6444):
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.

(https://nvd.nist.gov/vuln/detail/CVE-2019-6443):
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntp

(https://nvd.nist.gov/vuln/detail/CVE-2019-6442):
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.


@security, Alias please?
Comment 4 Anthony Basile gentoo-dev 2019-05-23 19:17:55 UTC 
ntpsec-1.1.3 is on the tree, and the vulnerable versions are off.
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2019-05-24 05:11:26 UTC 
(In reply to Anthony Basile from comment #4)
> ntpsec-1.1.3 is on the tree, and the vulnerable versions are off.

Thanks, Doc!
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2020-04-17 05:16:59 UTC 
CVE-2019-6445 (https://nvd.nist.gov/vuln/detail/CVE-2019-6445):
  An issue was discovered in NTPsec before 1.1.3. An authenticated attacker
  can cause a NULL pointer dereference and ntpd crash in ntp_control.c,
  related to ctl_getitem.

CVE-2019-6444 (https://nvd.nist.gov/vuln/detail/CVE-2019-6444):
  An issue was discovered in NTPsec before 1.1.3. process_control() in
  ntp_control.c has a stack-based buffer over-read because attacker-controlled
  data is dereferenced by ntohl() in ntpd.

CVE-2019-6443 (https://nvd.nist.gov/vuln/detail/CVE-2019-6443):
  An issue was discovered in NTPsec before 1.1.3. Because of a bug in
  ctl_getitem, there is a stack-based buffer over-read in read_sysvars in
  ntp_control.c in ntpd.

CVE-2019-6442 (https://nvd.nist.gov/vuln/detail/CVE-2019-6442):
  An issue was discovered in NTPsec before 1.1.3. An authenticated attacker
  can write one byte out of bounds in ntpd via a malformed config request,
  related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and
  yyerror in ntp_parser.y.