As we have already mentioned in our previous publication, NTP protocol servers (which are used to set the timing on network devices) are susceptible to remote code execution attacks, through the exploitation of vulnerabilities recently discovered in the Network Time Protocol (NTP).
The Network Time Foundation issued a warning about the risks of NTP servers that have not received the latest protocol update (4.2.8), which was released on December 18. ICS-CERT had also informed users of the risk of unupdated systems.
The organization disclosed a total of six vulnerabilities, identifying two of them as critical, while the remaining four pose a lower risk. Successful exploitation of the vulnerabilities does not require advanced knowledge and an attacker could execute arbitrary code remotely, gaining the same privileges as the ntpd process. If the process is run with elevated privileges, then an attacker could gain root access to the machine and take full control. However, if lower privileges are used to run the process, which is the most likely scenario, attackers would have to look for ways to increase their privileges on the machine.
Additionally, researchers identified three buffer overflow vulnerabilities (in “crypto_recv()”, “ctl_putdata()” and “Configure()”), which could be exploited by sending a specially crafted packet to overflow the buffer and remotely execute arbitrary code on the system.
Administrators running unpatched NTP servers are urged to apply the updates as soon as possible in order to eliminate the risk of remote code execution and distributed denial of service (DDoS) attacks.
