Vulnerability Name:

CVE-2001-0414 (CCN-6321)

Assigned:2001-04-04
Published:2001-04-04
Updated:2017-10-10
Summary:Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.8 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.8 High (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: FreeBSD Security Advisory FreeBSD-SA-01:31
ntpd contains potential remote compromise

Source: FREEBSD
Type: UNKNOWN
FreeBSD-SA-01:31

Source: NETBSD
Type: UNKNOWN
NetBSD-SA2001-004

Source: CCN
Type: Caldera International, Inc. Security Advisory CSSA-2001-013.0
remote root exploit in ntpd

Source: CCN
Type: SCO System Security Enhancement (SSE) SSE073 - 11-Apr-2001
SCO OpenServer NTP buffer overflow fix

Source: SCO
Type: UNKNOWN
SSE073

Source: SCO
Type: UNKNOWN
SSE074

Source: CCN
Type: BugTraq Mailing List, Wed Apr 04 2001 - 15:27:01 CDT
ntpd =< 4.0.99k remote buffer overflow

Source: CCN
Type: BugTraq Mailing List, Wed Apr 04 2001 - 20:49:01 CDT
Re: ntpd =< 4.0.99k remote buffer overflow

Source: CCN
Type: NetBSD Security Advisory 2001-004
NTP remote buffer overflow

Source: CCN
Type: BugTraq Mailing List, Mon Apr 09 2001 - 10:31:45 CDT
ntp-4.99k23.tar.gz is available

Source: CCN
Type: Progeny Linux Systems Security Advisory PROGENY-SA-2001-02
ntpd remote buffer overflow

Source: CCN
Type: BugTraq Mailing List, Mon Apr 09 2001 - 04:29:15 CDT
ntpd - new Debian 2.2 (potato) version is also vulnerable

Source: BUGTRAQ
Type: UNKNOWN
20010409 [ESA-20010409-01] xntp buffer overflow

Source: CCN
Type: EnGarde Secure Linux Security Advisory ESA-20010409-01
xntp3

Source: CCN
Type: Trustix Secure Linux Security Advisory #2001-0004
Xntpd

Source: CCN
Type: SuSE Security Announcement SuSE-SA:2001:010
xntp

Source: CCN
Type: BugTraq Mailing List, Thu Apr 12 2001 - 03:18:58 CDT
IOS and NTP

Source: BUGTRAQ
Type: UNKNOWN
20010413 PROGENY-SA-2001-02A: [UPDATE] ntpd remote buffer overflow

Source: BUGTRAQ
Type: UNKNOWN
20010418 IBM MSS Outside Advisory Redistribution: IBM AIX: Buffer Overflow Vulnerability in (x)ntp

Source: CCN
Type: Immunix OS Security Advisory IMNX-2001-70-013-01
ntp and xntp3

Source: CCN
Type: Compaq Security Advisory SSRT1-85U
xntpd potential buffer overflow

Source: MITRE
Type: CNA
CVE-2001-0414

Source: CONECTIVA
Type: UNKNOWN
CLA-2001:392

Source: CCN
Type: Conectiva Linux Announcement CLSA-2001:392
xntp3

Source: CCN
Type: Hewlett-Packard Company Security Bulletin HPSBUX0104-148
Sec. Vulnerability in xntpd(1M) (revised 02)

Source: SUSE
Type: UNKNOWN
SuSE-SA:2001:10

Source: BUGTRAQ
Type: UNKNOWN
20010404 ntpd =< 4.0.99k remote buffer overflow

Source: BUGTRAQ
Type: UNKNOWN
20010405 Re: ntpd =< 4.0.99k remote buffer overflow]

Source: BUGTRAQ
Type: UNKNOWN
20010406 Immunix OS Security update for ntp and xntp3

Source: BUGTRAQ
Type: UNKNOWN
20010408 [slackware-security] buffer overflow fix for NTP

Source: BUGTRAQ
Type: UNKNOWN
20010409 ntp-4.99k23.tar.gz is available

Source: BUGTRAQ
Type: UNKNOWN
20010409 PROGENY-SA-2001-02: ntpd remote buffer overflow

Source: BUGTRAQ
Type: UNKNOWN
20010409 ntpd - new Debian 2.2 (potato) version is also vulnerable

Source: CCN
Type: RHSA-2001-045
Network Time Daemon (ntpd) has potential remote root exploit

Source: CCN
Type: Sun Microsystems, Inc. Security Bulletin #00211
xntpd

Source: CALDERA
Type: UNKNOWN
CSSA-2001-013

Source: CCN
Type: CIAC Information Bulletin L-071
Network Time Protocol (NTP) Vulnerabilities

Source: CCN
Type: Cisco Systems Inc. Security Advisory, 2002 May 08 16:00 (UTC+0000)
NTP Vulnerability

Source: DEBIAN
Type: DSA-045
ntpd -- remote root exploit

Source: CCN
Type: Time WWW server
Tim Synchronization Server

Source: CCN
Type: US-CERT VU#970472
Network Time Protocol ([x]ntpd) daemon contains buffer overflow in ntp_control:ctl_getitem() function

Source: MANDRAKE
Type: Patch, Vendor Advisory
MDKSA-2001:036

Source: OSVDB
Type: UNKNOWN
805

Source: CCN
Type: OSVDB ID: 805
NTP ntpd readvar Variable Remote Overflow

Source: REDHAT
Type: UNKNOWN
RHSA-2001:045

Source: BID
Type: Exploit, Patch, Vendor Advisory
2540

Source: CCN
Type: BID-2540
Ntpd Remote Buffer Overflow Vulnerability

Source: CCN
Type: Slackware Security Advisory-1266
buffer overflow fix for NTP

Source: CCN
Type: MandrakeSoft Security Advisory MDKSA-2001:036
ntp/xntp3

Source: XF
Type: UNKNOWN
ntpd-remote-bo(6321)

Source: XF
Type: UNKNOWN
ntpd-remote-bo(6321)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:3831

Source: DEBIAN
Type: UNKNOWN
DSA-045

Vulnerable Configuration:Configuration 1:
  • cpe:/a:dave_mills:ntpd:4.0.99:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99a:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99b:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99c:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99d:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99e:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99f:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99g:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99h:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99i:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:4.0.99j:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:ntpd:*:*:*:*:*:*:*:* (Version <= 4.0.99k)
  • OR cpe:/a:dave_mills:xntp3:5.93:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:xntp3:5.93a:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:xntp3:5.93b:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:xntp3:5.93c:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:xntp3:5.93d:*:*:*:*:*:*:*
  • OR cpe:/a:dave_mills:xntp3:5.93e:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/o:freebsd:freebsd:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:3.1:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:3.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:6.2:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:aix:4.3:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:3.3:-:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:aix:4.3.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:6.2:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:3.4:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:6.3:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:6.4:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:2.2:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:6.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:3.5:*:*:*:*:*:*:*
  • OR cpe:/a:connectiva:linux:-:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:6.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:6.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7:*:*:*:*:*:*:*
  • OR cpe:/o:netbsd:netbsd:1.4:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:4.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:netbsd:netbsd:1.5:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:freebsd:freebsd:4.2:*:*:*:*:*:*:*
  • OR cpe:/o:trustix:secure_linux:-:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:slackware:slackware_linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:engardelinux:secure_community:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:aix:5.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.1:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:aix:4.3.3:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.2:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux:7.3:*:*:*:*:*:*:*
  • OR cpe:/o:ibm:aix:4.3.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:5402
    V
    		Multiple Vendor NTP Buffer Overflow
    2008-09-08
    oval:org.mitre.oval:def:3831
    V
    		Buffer Overflow in ntp Daemon via readvar
    2005-06-01
    BACK
    dave_mills ntpd 4.0.99
    dave_mills ntpd 4.0.99a
    dave_mills ntpd 4.0.99b
    dave_mills ntpd 4.0.99c
    dave_mills ntpd 4.0.99d
    dave_mills ntpd 4.0.99e
    dave_mills ntpd 4.0.99f
    dave_mills ntpd 4.0.99g
    dave_mills ntpd 4.0.99h
    dave_mills ntpd 4.0.99i
    dave_mills ntpd 4.0.99j
    dave_mills ntpd *
    dave_mills xntp3 5.93
    dave_mills xntp3 5.93a
    dave_mills xntp3 5.93b
    dave_mills xntp3 5.93c
    dave_mills xntp3 5.93d
    dave_mills xntp3 5.93e
    freebsd freebsd 3.0
    freebsd freebsd 3.1
    freebsd freebsd 3.2
    suse suse linux 6.2
    ibm aix 4.3
    freebsd freebsd 3.3 -
    suse suse linux 6.0
    ibm aix 4.3.2
    redhat linux 6.2
    freebsd freebsd 3.4
    suse suse linux 6.3
    suse suse linux 6.4
    debian debian linux 2.2
    slackware slackware linux 7.0
    mandrakesoft mandrake linux 7.0
    suse suse linux 6.1
    mandrakesoft mandrake linux 7.1
    freebsd freebsd 3.5
    connectiva linux -
    mandrakesoft mandrake linux 6.0
    mandrakesoft mandrake linux 6.1
    redhat linux 7
    netbsd netbsd 1.4
    freebsd freebsd 4.1
    mandrakesoft mandrake linux 7.2
    netbsd netbsd 1.5
    suse suse linux 7.0
    mandrakesoft mandrake linux corporate server 1.0.1
    freebsd freebsd 4.2
    trustix secure linux -
    suse suse linux 7.1
    slackware slackware linux 7.1
    engardelinux secure community 1.0.1
    ibm aix 5.1
    redhat linux 7.1
    ibm aix 4.3.3
    redhat linux 7.2
    redhat linux 7.3
    ibm aix 4.3.1