Lucene search

[email protected]CVE-2023-26554

HistoryApr 11, 2023 - 9:15 p.m.

CVE-2023-26554

2023-04-1121:15:21

CWE-787

[email protected]

web.nvd.nist.gov

cve

ntp

4.2.8p15

out-of-bounds write

mstolfp.c

security vulnerability

5.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a ‘\0’ character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Affected configurations

NVD

Node

ntpntpMatch4.2.8p15

CPENameOperatorVersion
ntp:ntpntpeq4.2.8

CPE	Name	Operator	Version
ntp:ntp	ntp	eq	4.2.8

References

github.com/spwpun/ntp-4.2.8p15-cves/blob/main/CVE-2023-26554

github.com/spwpun/ntp-4.2.8p15-cves/issues/1#issuecomment-1506667321

5.6 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.3%

JSON

Related for CVE-2023-26554

nvd1 redhatcve1 ubuntucve1 debiancve1 prion1 cvelist1 osv1 ics1 aix1 openvas15 nessus18 ibm1 slackware1 amazon1 photon3