NTP BUG 3382: Data Structure terminated insufficiently (Windows installer ONLY)

Last update: June 27, 2022 20:45 UTC (51d68a4aa)

Summary

Resolved 4.2.8p10 21 Mar 2017
References Bug 3382 CVE-2017-6459
Affects Windows installer ONLY: All ntp-4 versions of the Windows installer, up to
but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94.		 Resolved in 4.2.8p10.
CVSS2 Score LOW 1.0 AV:L/AC:H/Au:S/C:N/I:N/A:P
CVSS3 Score LOW 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L

Description

The Windows installer for NTP calls strcpy() with an argument that specifically contains multiple null bytes. strcpy() only copies a single terminating null character into the target buffer instead of copying the required double null bytes in the addKeysToRegistry() function. As a consequence, a garbage registry entry can be created. The additional arsize parameter is erroneously set to contain two null bytes and the following call to RegSetValueEx() claims to be passing in a multi-string value, though this may not be true.

Mitigation

Credit

This weakness was discovered by Cure53.

Timeline