[stalk:00296] Re: ntpd =< 4.0.99k remote buffer overflow

[Seiichi Nakashima <nakasei@xxxxxxxxxxxx>]

中島です。

Bugtraq の ML から抜粋しています。

NTPの問題はより大きな問題になる可能性があるようです。


In message "Re: ntp-4.99k23.tar.gz is available",
Fyodor wrote...

 >> > Has anyone tested the exploit against embedded ntp implementations
 >> > such as in Cisco router, for example, to see if the daemon would
 >> > misbehave, etc.?
 >>
 >> I couldn't do anything to the NTP implementation of a Cisco router
 >> here with the stock "ntpdx" exploit as it was posted.  (It doesn't
 >> crash, it doesn't exhibit same heap corruption as xntpd v3.)
 >>
 >
 >Cisco IOS (at least 11.x series) _IS_ vulnerable (tested, confirmed). Earlier
 >versions are presumably vulnerable too. Haven't tested IOS 12.x but it may have
 >the same bug inherited as well (unless cisco folks found the problem and fixed
 >it silently).


----
Seiichi Nakashima  nakasei@xxxxxxxxxxxx
--
- このメイリングリストに関する質問・問い合せ等は
- <security-talk@xxxxxxxxxx>までお知らせください
--
------------------------------------------------------------------------
　　　◆ダイエットの味方カプサイシン、何のことだか説明できる？
　　 http://www.infoseek.co.jp/GHome?pg=gn_top.html&svx=971122