Description
Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
NTP Daemon readvar Buffer Overflow
exploit/multi/ntp/ntp_overflow
Exploit-DB 3
- NTP daemon readvar - Remote Buffer Overflow (Metasploit) EDB-16285 · remote · Aug 25, 2010 · verified
- NTPd 4.0.99j-k readvar - Remote Buffer Overflow (Metasploit) EDB-9940 · remote · Apr 4, 2001 · verified
- NTPd - Remote Buffer Overflow EDB-20727 · remote · Apr 4, 2001 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- RHSA-2001:045 vendor-advisory
- SuSE-SA:2001:10 vendor-advisory
- 20010409 [ESA-20010409-01] xntp buffer overflow mailing-list
- 20010409 ntp-4.99k23.tar.gz is available mailing-list
- MDKSA-2001:036 vendor-advisory
- 20010404 ntpd =< 4.0.99k remote buffer overflow mailing-list
- CLA-2001:392 vendor-advisory
- 805 vdb-entry
- 20010409 ntpd - new Debian 2.2 (potato) version is also vulnerable mailing-list
- 2540 vdb-entry
- oval:org.mitre.oval:def:3831 vdb-entry signature
- 20010406 Immunix OS Security update for ntp and xntp3 mailing-list
- 20010405 Re: ntpd =< 4.0.99k remote buffer overflow] mailing-list
- 20010413 PROGENY-SA-2001-02A: [UPDATE] ntpd remote buffer overflow mailing-list
- 20010408 [slackware-security] buffer overflow fix for NTP mailing-list
- 20010418 IBM MSS Outside Advisory Redistribution: IBM AIX: Buffer Overflow Vulnerability in (x)ntp mailing-list
- 20010409 PROGENY-SA-2001-02: ntpd remote buffer overflow mailing-list
- DSA-045 vendor-advisory
- ntpd-remote-bo(6321) vdb-entry
- CSSA-2001-013 vendor-advisory