National Cyber Awareness System

Vulnerability Summary for CVE-2001-0414

Overview

Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.

Impact

CVSS Severity (version 2.0 incomplete approximation):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: BID

Name: 2540

Type: Advisory; Patch Information; Exploit

Hyperlink:http://www.securityfocus.com/bid/2540

External Source: MANDRAKE

Name: MDKSA-2001:036

Type: Advisory; Patch Information

Hyperlink:http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-036.php3

External Source: DEBIAN

Name: DSA-045

Type: Advisory

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98651866104663&w=2

External Source: XF

Name: ntpd-remote-bo(6321)

Hyperlink:http://xforce.iss.net/static/6321.php

External Source: REDHAT

Name: RHSA-2001:045

Hyperlink:http://www.redhat.com/support/errata/RHSA-2001-045.html

External Source: OSVDB

Name: 805

Hyperlink:http://www.osvdb.org/805

External Source: CALDERA

Name: CSSA-2001-013

Hyperlink:http://www.calderasystems.com/support/security/advisories/CSSA-2001-013.0.txt

External Source: BUGTRAQ

Name: 20010409 ntpd - new Debian 2.2 (potato) version is also vulnerable

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98684532921941&w=2

External Source: BUGTRAQ

Name: 20010409 PROGENY-SA-2001-02: ntpd remote buffer overflow

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98684202610470&w=2

External Source: BUGTRAQ

Name: 20010409 ntp-4.99k23.tar.gz is available

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98683952401753&w=2

External Source: BUGTRAQ

Name: 20010408 [slackware-security] buffer overflow fix for NTP

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98679815917014&w=2

External Source: BUGTRAQ

Name: 20010406 Immunix OS Security update for ntp and xntp3

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98659782815613&w=2

External Source: BUGTRAQ

Name: 20010405 Re: ntpd =< 4.0.99k remote buffer overflow]

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98654963328381&w=2

External Source: BUGTRAQ

Name: 20010404 ntpd =< 4.0.99k remote buffer overflow

Hyperlink:http://marc.theaimsgroup.com/?l=bugtraq&m=98642418618512&w=2

External Source: SUSE

Name: SuSE-SA:2001:10

Hyperlink:http://lists.suse.com/archives/suse-security-announce/2001-Apr/0000.html

External Source: CONECTIVA

Name: CLA-2001:392

Hyperlink:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000392

External Source: BUGTRAQ

Name: 20010418 IBM MSS Outside Advisory Redistribution: IBM AIX: Buffer Overflow Vulnerability in (x)ntp

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2001-04/0314.html

External Source: BUGTRAQ

Name: 20010413 PROGENY-SA-2001-02A: [UPDATE] ntpd remote buffer overflow

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2001-04/0225.html

External Source: BUGTRAQ

Name: 20010409 [ESA-20010409-01] xntp buffer overflow

Hyperlink:http://archives.neohapsis.com/archives/bugtraq/2001-04/0127.html

External Source: SCO

Name: SSE074

Hyperlink:ftp://ftp.sco.com/SSE/sse074.ltr

External Source: SCO

Name: SSE073

Hyperlink:ftp://ftp.sco.com/SSE/sse073.ltr

External Source: NETBSD

Name: NetBSD-SA2001-004

Hyperlink:ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA2001-004.txt.asc

External Source: FREEBSD

Name: FreeBSD-SA-01:31

Hyperlink:ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-01:31.ntpd.asc

US Government Resource: oval:org.mitre.oval:def:3831

Name: oval:org.mitre.oval:def:3831

Type: Tool Signature

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:3831

References to Check Content

Identifier:oval:org.mitre.oval:def:5402

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:5402

Identifier:oval:org.mitre.oval:def:3831

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:3831