20010404 ntpd.patch This fixes a ROOT-vulnerability in NTPD. Index: ntp_control.c =================================================================== RCS file: /home/ncvs/src/contrib/ntp/ntpd/ntp_control.c,v retrieving revision 1.1.1.2 diff -u -r1.1.1.2 ntp_control.c --- ntp_control.c 2000/01/28 14:53:03 1.1.1.2 +++ ntp_control.c 2001/04/04 23:02:23 @@ -1649,8 +1649,20 @@ tp = buf; while (cp < reqend && isspace((int)*cp)) cp++; - while (cp < reqend && *cp != ',') + while (cp < reqend && *cp != ',') { *tp++ = *cp++; + if (tp > buf + sizeof(buf)) { + msyslog(LOG_WARNING, "Attempted \"ntpdx\" exploit from IP %d.%d.%d.%d:%d (possibly spoofed)\n", + (ntohl(rmt_addr->sin_addr.s_addr) >> 24) & 0xff, + (ntohl(rmt_addr->sin_addr.s_addr) >> 16) & 0xff, + (ntohl(rmt_addr->sin_addr.s_addr) >> 8) & 0xff, + (ntohl(rmt_addr->sin_addr.s_addr) >> 0) & 0xff, + ntohs(rmt_addr->sin_port) +); + + return (0); + } + } if (cp < reqend) cp++; *tp = '\0';