Tutorial - NTP Vulnerabilities

##
NTP Vulnerabilities

Created 4/11/01
CVE 2001-0414

### Impact

If this vulnerability is present, a remote attacker could gain root access to an affected system.

### Background

The Network Time Protocol (NTP) is used to synchronize a computer's system clock with that of a time server. The NTP daemon (`ntpd`) processes NTP queries from clients. `ntpd` is often included in Unix and Linux operating system distributions.

### The Problem

Due to a buffer overflow condition in `ntpd`, it is possible for a remote attacker to execute arbitrary commands with the same privileges as the `ntpd` process, which is usually root. The buffer overflow occurs in the processing of queries with a very long `readvar` argument.

Versions of `ntpd` prior to and including 4.0.99k are affected by this vulnerability.

### Resolution

To find out if your version of `ntpd` is vulnerable, enter the command:

    ntpq -c version

If the version is 4.0.99k or lower, then upgrade your `ntpd` package to the latest version.

### Where can I read more about this?

This vulnerability was reported in CIAC Bulletin L-071 and in security advisories from many vendors, including NetBSD, Red Hat, Debian, Caldera, Sun, and Cisco. Note that this vulnerability could affect any system on which `ntpd` is running, even if the vendor is not listed above.