FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-28 15:43:32 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
c2576e14-36e2-11e9-9eda-206a8a720317ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet

Network Time Foundation reports:

A crafted malicious authenticated mode 6 (ntpq) packet from a permitted network address can trigger a NULL pointer dereference, crashing ntpd.

Note that for this attack to work, the sending system must be on an address that the target's ntpd accepts mode 6 packets from, and must use a private key that is specifically listed as being used for mode 6 authorization.

Impact: The ntpd daemon can crash due to the NULL pointer dereference, causing a denial of service.

Mitigation:

  • Use restrict noquery to limit addresses that can send mode 6 queries.
  • Limit access to the private controlkey in ntp.keys.
  • Upgrade to 4.2.8p13, or later.

Discovery 2019-01-15
Entry 2019-03-07
Modified 2019-07-30
ntp
< 4.2.8p13

FreeBSD
ge 12.0 lt 12.0_2

ge 11.2 lt 11.2_8

http://bugs.ntp.org/3565
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8936
https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:H/Au:M/C:N/I:N/A:C)
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
CVE-2019-8936
SA-19:04.ntp