Description
ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.kb.cert.org/vuls/id/852879 ↗
- http://support.ntp.org/bin/view/Main/SecurityNotice#December_2014_NTP_Security_Vulne ↗
- http://www.securityfocus.com/bid/72583 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1184573 ↗
- http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html ↗
- http://www.debian.org/security/2015/dsa-3388 ↗
- http://rhn.redhat.com/errata/RHSA-2015-1459.html ↗
- http://bugs.ntp.org/show_bug.cgi?id=2671 ↗
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03886en_us ↗