Lucene search

MitreCVE-2023-26554

HistoryApr 11, 2023 - 9:15 p.m.

CVE-2023-26554

2023-04-1121:15:21

CWE-787

mitre

web.nvd.nist.gov

cve

ntp

4.2.8p15

out-of-bounds write

mstolfp.c

security vulnerability

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

37.9%

JSON

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a ‘\0’ character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Affected configurations

Nvd

Node

ntpntpMatch4.2.8p15

VendorProductVersionCPE
ntpntp4.2.8cpe:2.3:a:ntp:ntp:4.2.8:p15:*:*:*:*:*:*

Vendor	Product	Version	CPE
ntp	ntp	4.2.8	cpe:2.3:a:ntp:ntp:4.2.8:p15::::::

References

github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554

github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321

CVSS3

5.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

5.8

Confidence

High

EPSS

0.001

Percentile

37.9%

JSON

Related for CVE-2023-26554