Description
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | ntp | 4.2.8p10-60.1 | SUSE-SU-2017:1048-1 |
| SLES 12 SP1 | ntp | 4.2.8p10-60.1 | SUSE-SU-2017:1048-1 |
| SLES 12 | ntp | 4.2.8p10-46.23.1 | SUSE-SU-2017:1047-1 |
| SLES 11 SP4 | ntp | 4.2.8p10-63.1 | SUSE-SU-2017:1052-1 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP2 | ntp | 4.2.8p10-60.1 | SUSE-SU-2017:1048-1 |
| SLES for SAP 12 SP1 | ntp | 4.2.8p10-60.1 | SUSE-SU-2017:1048-1 |
| SLES for SAP 12 | ntp | 4.2.8p10-46.23.1 | SUSE-SU-2017:1047-1 |
| SLES for SAP 11 SP4 | ntp | 4.2.8p10-63.1 | SUSE-SU-2017:1052-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ntp | 4.2.8p15-7.2 | openSUSE-SU-2024:11102-1 |
Advisories 6
- openSUSE-SU-2024:11102-1 ntp-4.2.8p15-7.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1048-1 Security update for ntp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1052-1 Security update for ntp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:1047-1 Security update for ntp SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0370 Apple Mac OS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 13, 2025
- VDE-2022-032 AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service CERT@VDE · Aug 9, 2022
References
- http://support.ntp.org/bin/view/Main/NtpBug3378
- 1038123 vdb-entry
- 97058 vdb-entry
- https://support.apple.com/HT208144
- 1039427 vdb-entry
- http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbux03962en_us