MEDIUM
ntp: an out-of-bounds write when adding a '\0' character
Published Apr 11, 2023
5.6
MEDIUMCVSS 3.1
EPSS 0.64%
Description
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Affected products
No data.
No data.
Red Hat Enterprise Linux 6
ntp
Out of support scope
Red Hat Enterprise Linux 7
ntp
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | ntp | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | ntp | Will not fix | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (6)
- https://access.redhat.com/security/cve/CVE-2023-26554 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2186492 Issue Tracking
- https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554 Third Party Advisory
- https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-26554
- https://www.cve.org/CVERecord?id=CVE-2023-26554
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-26554 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2186492 | Issue Tracking | |
| https://github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554 | Third Party Advisory | |
| https://github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321 | Third Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2023-26554 | ||
| https://www.cve.org/CVERecord?id=CVE-2023-26554 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 11, 2023
Updated Feb 11, 2025
Reserved Feb 25, 2023
Link CVE-2023-26554
CISA Vulnrichment
Updated Feb 11, 2025