Skip to content
OpenAdvisories
Medium ALAS2-2024-2396 5 CVEs

Moderate: ntp security update (Amazon Linux 2)

Published Jan 3, 2024 · Updated Feb 15, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-26555: praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. CVE-2023-26554: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. CVE-2023-26553: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. CVE-2023-26552: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. CVE-2023-26551: mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 ntp 0:4.2.8p15-3.amzn2.0.7
Amazon Linux · 2 ntp-debuginfo 0:4.2.8p15-3.amzn2.0.7
Amazon Linux · 2 ntp-doc 0:4.2.8p15-3.amzn2.0.7
Amazon Linux · 2 ntp-perl 0:4.2.8p15-3.amzn2.0.7
Amazon Linux · 2 ntpdate 0:4.2.8p15-3.amzn2.0.7
Amazon Linux · 2 sntp 0:4.2.8p15-3.amzn2.0.7

Vulnerabilities 5

  • Medium 6.4
    CVE-2023-26555

    praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be comple…

    ntp ntp Debian Ubuntu
  • Medium 5.6
    CVE-2023-26551

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be …

    ntp ntp Debian Ubuntu
  • Medium 5.6
    CVE-2023-26552

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be…

    ntp ntp Debian Ubuntu
  • Medium 5.6
    CVE-2023-26553

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary m…

    ntp ntp Debian Ubuntu
  • Medium 5.6
    CVE-2023-26554

    mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may b…

    ntp ntp Debian Ubuntu

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26551.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26552.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26553.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26554.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-26555.html