REDHAT-BUG-531213: High severity Alcatel-Lucent ntpd vulnerability
Robin Park and Dmitri Vinokurov of Alcatel-Lucent discovered a flaw in the way ntpd handles certain mode 7 packets. A remote attacker able to send specially-crafted mode 7 NTP packet with a spoofed source IP address could cause ntpd running on one host, or two ntpds running on two hosts to send error packets in loop, resulting in excessive use of CPU and disk space (via logging).
Issue is tracked by US-CERT as VU#568372.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-531213?
The severity of REDHAT-BUG-531213 is considered critical due to the potential for remote code execution.
How do I fix REDHAT-BUG-531213?
To fix REDHAT-BUG-531213, you should upgrade your ntpd to the latest patched version provided by Alcatel-Lucent.
What systems are affected by REDHAT-BUG-531213?
REDHAT-BUG-531213 affects any systems running Alcatel-Lucent ntpd that are configured to process mode 7 packets.
Can REDHAT-BUG-531213 be exploited remotely?
Yes, REDHAT-BUG-531213 can be exploited remotely by an attacker sending specially-crafted NTP packets with a spoofed source IP.
What are the consequences of REDHAT-BUG-531213 exploitation?
Exploitation of REDHAT-BUG-531213 could lead to denial of service or unauthorized access to affected systems.