d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix a potential ROOT-exploit in NTPD.

Browse Source 
PR:		26358
Reviewed by:	dima
This commit is contained in:
Poul-Henning Kamp 2001-04-04 23:07:22 +00:00
parent 4464fee503
commit 0cad4cb4e6
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=75202
1 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
contrib/ntp/ntpd/ntp_control.c
View File

@ -1,6 +1,11 @@
/*
* ntp_control.c - respond to control messages and send async traps
*/
/*
* $FreeBSD$
*/
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
@ -1649,8 +1654,20 @@ ctl_getitem(
tp = buf;
while (cp < reqend && isspace((int)*cp))
cp++;
while (cp < reqend && *cp != ',')
while (cp < reqend && *cp != ',') {
*tp++ = *cp++;
if (tp > buf + sizeof(buf)) {
msyslog(LOG_WARNING, "Attempted \"ntpdx\" exploit from IP %d.%d.%d.%d:%d (possibly spoofed)\n",
(ntohl(rmt_addr->sin_addr.s_addr) >> 24) & 0xff,
(ntohl(rmt_addr->sin_addr.s_addr) >> 16) & 0xff,
(ntohl(rmt_addr->sin_addr.s_addr) >> 8) & 0xff,
(ntohl(rmt_addr->sin_addr.s_addr) >> 0) & 0xff,
ntohs(rmt_addr->sin_port)
);
return (0);
}
}
if (cp < reqend)
cp++;
*tp = '\0';