NTP4 távoli kódfuttatás sebezhetőség

https://rhn.redhat.com/errata/RHSA-2014-2025.html

"Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(),
ctl_putdata(), and configure() functions. A remote attacker could use
either of these flaws to send a specially crafted request packet that could
crash ntpd or, potentially, execute arbitrary code with the privileges of
the ntp user. Note: the crypto_recv() flaw requires non-default
configurations to be active, while the ctl_putdata() flaw, by default, can
only be exploited via local attackers, and the configure() flaw requires
additional authentication to exploit. (CVE-2014-9295)"

--
trey @ gépház

Lazán kapcsolódik:

Poul-Henning Kamp - FreeBSD és egyéb nyílt forrású szoftverek fejlesztője - a The Linux Foundation szponzorálásával elkezdte átnézni az ntp.org szoftverének (NTPD) forrását, de arra jutott, hogy sokkal egyszerűbb 0-ról újraírni a cuccot, mint a több mint 100 ezer programsorból álló meglevőből kiszórni a felesleges kódsorokat.

Az újraírás folyamatban van.

Theo de Raadt-nak volt néhány tanácsa, kérése PHK felé:

"I am glad to hear NTPD is being rewritten. Because over time this
will bring safety back back into focus. PHK, I hope you don't just
focus on the math. Privsep it, please, but ensure DNS refresh is
possible in the architecture you choose. There is a time-tested model
which does not require the OS to have this or that non-standard
security feature; we all know we can't mandate use of those features
which barely help anyways. You rely on privsep everytime you login to
another machine, so consider it."

--
trey @ gépház