BID:37255

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability

Info

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability

Bugtraq ID:	37255
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-3563
Remote:	Yes
Local:	No
Published:	Dec 08 2009 12:00AM
Updated:	May 12 2015 07:46PM
Credit:	Robin Park and Dmitri Vinokurov
Vulnerable:	VMWare vMA 4.0 VMWare ESXi Server 4.0 VMWare ESXi Server 3.5 VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 SP3 SuSE SUSE Linux Enterprise Server 10 SP2 Sun SPARC T3-4 0 Sun SPARC T3-2 0 Sun SPARC T3-1B 0 Sun SPARC T3-1 0 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Sun OpenSolaris build snv_99 Sun OpenSolaris build snv_98 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_94 Sun OpenSolaris build snv_93 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_86 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_84 Sun OpenSolaris build snv_83 Sun OpenSolaris build snv_82 Sun OpenSolaris build snv_81 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_78 Sun OpenSolaris build snv_77 Sun OpenSolaris build snv_76 Sun OpenSolaris build snv_71 Sun OpenSolaris build snv_68 Sun OpenSolaris build snv_67 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_61 Sun OpenSolaris build snv_59 Sun OpenSolaris build snv_58 Sun OpenSolaris build snv_57 Sun OpenSolaris build snv_56 Sun OpenSolaris build snv_54 Sun OpenSolaris build snv_51 Sun OpenSolaris build snv_50 Sun OpenSolaris build snv_49 Sun OpenSolaris build snv_48 Sun OpenSolaris build snv_47 Sun OpenSolaris build snv_45 Sun OpenSolaris build snv_41 Sun OpenSolaris build snv_39 Sun OpenSolaris build snv_38 Sun OpenSolaris build snv_37 Sun OpenSolaris build snv_36 Sun OpenSolaris build snv_35 Sun OpenSolaris build snv_29 Sun OpenSolaris build snv_28 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_132 Sun OpenSolaris build snv_131 Sun OpenSolaris build snv_130 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_129 Sun OpenSolaris build snv_128 Sun OpenSolaris build snv_127 Sun OpenSolaris build snv_126 Sun OpenSolaris build snv_125 Sun OpenSolaris build snv_124 Sun OpenSolaris build snv_123 Sun OpenSolaris build snv_122 Sun OpenSolaris build snv_121 Sun OpenSolaris build snv_120 Sun OpenSolaris build snv_119 Sun OpenSolaris build snv_118 Sun OpenSolaris build snv_117 Sun OpenSolaris build snv_116 Sun OpenSolaris build snv_115 Sun OpenSolaris build snv_114 Sun OpenSolaris build snv_113 Sun OpenSolaris build snv_112 Sun OpenSolaris build snv_111a Sun OpenSolaris build snv_111 Sun OpenSolaris build snv_110 Sun OpenSolaris build snv_109 Sun OpenSolaris build snv_108 Sun OpenSolaris build snv_107 Sun OpenSolaris build snv_106 Sun OpenSolaris build snv_105 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101a Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 Sun Netra SPARC T3-1B 0 Sun Netra SPARC T3-1 0 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux x86_64 -current Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 3.0 QNX RTOS 6.4.1 QNX RTOS 6.4 QNX RTOS 6.3.2 QNX RTOS 6.3 QNX RTOS 6.2.1 QNX RTOS 6.2 Update Patch A QNX RTOS 6.2 QNX RTOS 6.1 QNX RTOS 2.4 QNX RTOS 6.3.0 SP3 QNX RTOS 4.25 Pardus Linux 2008 0 NTP NTP 4.2.4 p4 NTP NTP 4.2.2 p4 NTP NTP 4.2.2 p1 NTP NTP 4.1.2 NTP NTP 4.2.0.a Nortel Networks Enterprise VoIP TM-CS1000 NetBSD NetBSD 5.0.1 NetBSD NetBSD 4.0.2 NetBSD NetBSD 4.0.1 NetBSD NetBSD 5.0 NetBSD NetBSD 4.0 BETA2 NetBSD NetBSD 4.0 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Juniper IDP 5.1 Juniper CTPOS 6.6R1 IBM AIX 6.1.3 IBM AIX 6.1.2 IBM AIX 6.1.1 IBM AIX 5.3.10 IBM AIX 5.3.9 IBM AIX 5.3.8 IBM AIX 5.3.7 IBM AIX 6.1 IBM AIX 5.3 HP TCP/IP Services for OpenVMS I64 5.7 HP TCP/IP Services for OpenVMS I64 5.6 HP TCP/IP Services for OpenVMS I64 5.5 HP TCP/IP Services for OpenVMS I64 5.4 HP TCP/IP Services for OpenVMS Alpha 5.7 HP TCP/IP Services for OpenVMS Alpha 5.6 HP TCP/IP Services for OpenVMS Alpha 5.5 HP TCP/IP Services for OpenVMS Alpha 5.4 HP HP-UX B.11.31 Gentoo Linux FreeBSD FreeBSD 6.0 .x FreeBSD FreeBSD 6.0 -STABLE FreeBSD FreeBSD 6.0 -RELEASE FreeBSD FreeBSD 8.0-STABLE FreeBSD FreeBSD 8.0-RELEASE FreeBSD FreeBSD 7.2-STABLE FreeBSD FreeBSD 7.2-RELEASE-p4 FreeBSD FreeBSD 7.2-RELEASE-p1 FreeBSD FreeBSD 7.2-RC2 FreeBSD FreeBSD 7.2-PRERELEASE FreeBSD FreeBSD 7.1-STABLE FreeBSD FreeBSD 7.1-RELEASE-p6 FreeBSD FreeBSD 7.1-RELEASE-p5 FreeBSD FreeBSD 7.1-RELEASE-p4 FreeBSD FreeBSD 7.1 -RELEASE-p2 FreeBSD FreeBSD 7.1 -RELEASE-p1 FreeBSD FreeBSD 7.1 -PRE-RELEASE FreeBSD FreeBSD 7.0-STABLE FreeBSD FreeBSD 7.0-RELEASE-p8 FreeBSD FreeBSD 7.0-RELEASE-p3 FreeBSD FreeBSD 7.0-RELEASE-p12 FreeBSD FreeBSD 7.0-RELEASE-p11 FreeBSD FreeBSD 7.0-RELEASE FreeBSD FreeBSD 7.0 BETA4 FreeBSD FreeBSD 7.0 -RELENG FreeBSD FreeBSD 7.0 -RELEASE-p9 FreeBSD FreeBSD 7.0 -PRERELEASE FreeBSD FreeBSD 7.0 FreeBSD FreeBSD 6.4-RELENG FreeBSD FreeBSD 6.4-RELEASE-p5 FreeBSD FreeBSD 6.4-RELEASE-p4 FreeBSD FreeBSD 6.4-RELEASE-p2 FreeBSD FreeBSD 6.4 -STABLE FreeBSD FreeBSD 6.4 -RELEASE-p3 FreeBSD FreeBSD 6.4 -RELEASE FreeBSD FreeBSD 6.3-RELEASE-p11 FreeBSD FreeBSD 6.3-RELEASE-p10 FreeBSD FreeBSD 6.3 -RELENG FreeBSD FreeBSD 6.3 -RELEASE-p9 FreeBSD FreeBSD 6.3 -RELEASE-p8 FreeBSD FreeBSD 6.3 -RELEASE-p6 FreeBSD FreeBSD 6.3 FreeBSD FreeBSD 6.0-RELENG FreeBSD FreeBSD 6.0 -RELEASE-p5 F5 BIG-IP Application Security Manager 9.4.8 F5 BIG-IP Application Security Manager 9.4.7 F5 BIG-IP Application Security Manager 9.4.6 F5 BIG-IP Application Security Manager 9.4.5 F5 BIG-IP Application Security Manager 9.4.4 F5 BIG-IP Application Security Manager 9.4.3 F5 BIG-IP 9.6.1 F5 BIG-IP 9.4.6 F5 BIG-IP 9.4.5 F5 BIG-IP 9.4.3 F5 BIG-IP 9.3.1 F5 BIG-IP 9.3 F5 BIG-IP 9.2.5 F5 BIG-IP 9.2.3 .30 F5 BIG-IP 9.2.3 F5 BIG-IP 9.2.2 F5 BIG-IP 9.1.1 F5 BIG-IP 9.1 F5 BIG-IP 9.0.5 F5 BIG-IP 9.0.4 F5 BIG-IP 9.0.3 F5 BIG-IP 9.0.2 F5 BIG-IP 9.0.1 F5 BIG-IP 9.0 F5 BIG-IP 1.0 F5 BIG-IP 9.6 F5 BIG-IP 9.4 F5 BIG-IP 9.3 F5 BIG-IP 9.24 Build 13.1 F5 BIG-IP 9.2 F5 BIG-IP 10.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Cisco Wireless Location Appliance 0 Cisco Wide Area Application Services (WAAS) 4.0.19 Cisco Wide Area Application Services (WAAS) 4.0.18 Cisco Wide Area Application Services (WAAS) 4.0.17 Cisco Wide Area Application Services (WAAS) 4.0.13 Cisco Wide Area Application Services (WAAS) 4.0.9 Cisco Wide Area Application Services (WAAS) 4.0.7 Cisco Wide Area Application Services (WAAS) 4.1.1b Cisco Wide Area Application Services (WAAS) 0 Cisco Unified MeetingPlace Express 0 Cisco Unified MeetingPlace 0 Cisco Unified Communications Manager 7.1(2a)su1 Cisco Unified Communications Manager 7.1(2) Cisco Unified Communications Manager 7.1 Cisco Unified Communications Manager 7.0(3g) Cisco Unified Communications Manager 7.0(2a)su1 Cisco Unified Communications Manager 7.0(2) Cisco Unified Communications Manager 7.0 Cisco Unified Communications Manager 6.1(4) Cisco Unified Communications Manager 6.1(3) Cisco Unified Communications Manager 6.1(2) Cisco Unified Communications Manager 6.1(1a) Cisco Unified Communications Manager 6.1(1) Cisco Unified Communications Manager 6.1 (3b)su1 Cisco Unified Communications Manager 6.1 (2)su1 Cisco Unified Communications Manager 6.1 Cisco Unified Communications Manager 6.0(1) Cisco Unified Communications Manager 6.0 (1a) Cisco Unified Communications Manager 5.1(3g) Cisco Unified Communications Manager 5.1(3e) Cisco Unified Communications Manager 5.1(3d) Cisco Unified Communications Manager 5.1(3C) Cisco Unified Communications Manager 5.1(3a) Cisco Unified Communications Manager 5.1(3) Cisco Unified Communications Manager 5.1(2b) Cisco Unified Communications Manager 5.1(2a) Cisco Unified Communications Manager 5.1(2) Cisco Unified Communications Manager 5.1(1) Cisco Unified Communications Manager 4.3(2)Sr1b Cisco Unified Communications Manager 4.3(2)SR1 Cisco Unified Communications Manager 4.3(2) Cisco Unified Communications Manager 4.3(1)Sr.1 Cisco Unified Communications Manager 4.3 Cisco Unified Communications Manager 4.2(3)sr2 Cisco Unified Communications Manager 4.2 (3)SR4 Cisco Unified Communications Manager 4.2 (3)SR3 Cisco Unified Communications Manager 4.2 (3)SR2b Cisco Unified Communications 500 (UC500) 0 Cisco Unified Communication Manager Business Edition 0 Cisco Unified CallManager 6.0 Cisco Unified CallManager 5.1 Cisco Unified CallManager 5.0(4a)SU1 Cisco Unified CallManager 5.0(4) Cisco Unified CallManager 5.0(3a) Cisco Unified CallManager 5.0(3) Cisco Unified CallManager 5.0(2) Cisco Unified CallManager 5.0(1) Cisco Unified CallManager 5.0 Cisco Unified CallManager 4.3(2)SR1a Cisco Unified CallManager 4.3(1)sr1 Cisco Unified CallManager 4.2(3)SR4b Cisco Unified CallManager 4.2(3)SR1 Cisco Unified CallManager 4.2 Cisco Unified CallManager 4.1(3)SR8a Cisco Unified CallManager 4.1(3)SR8 Cisco Unified CallManager 4.1(3)SR7 Cisco Unified CallManager 4.1(3)sr5 Cisco Unified CallManager 4.1(3)SR4 Cisco Unified CallManager 4.1 (3)SR5c Cisco Unified CallManager 4.1 (3)SR5b Cisco Unified CallManager 4.1 Cisco Unified CallManager 4.0 Cisco Unified CallManager 3.3(5)sr3 Cisco Unified CallManager 3.3(5)sr2b Cisco Unified CallManager 3.3(5)SR2a Cisco Unified CallManager 3.3 Cisco Telepresence Recording Server 0 Cisco TelePresence Readiness Assessment Manager (CTRAM) 1.0 Cisco Nexus 7000 0 Cisco Nexus 5000 0 Cisco MeetingPlace Cisco MDS 9500 0 Cisco IP Interoperability & Communications System IPICS 0 Cisco Digital Media Player 0 Cisco ACE XML Gateway 0 Cisco ACE Appliance 0 Cisco ACE 4700 Application Control Engine 0 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Voice Portal 3.0 Avaya Proactive Contact 4.1.1 Avaya Proactive Contact 3.0.2 Avaya Proactive Contact 4.1 Avaya Proactive Contact 4.0 Avaya Proactive Contact 3.0 Avaya Proactive Contact 0 Avaya Messaging Storage Server MM3.0 Avaya Messaging Storage Server 5.0 Avaya Messaging Storage Server 4.0 Avaya Messaging Storage Server 3.1 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking 5.2 Avaya Message Networking 3.1 Avaya Message Networking Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Intuity AUDIX LX R1.1 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Intuity AUDIX LX 1.0 Avaya CMS Server 16.0 Avaya CMS Server 15.0 Avaya CMS Server 14.1 Avaya CMS Server 14.0 Avaya Aura System Platform SP1.1 Avaya Aura System Platform 6.0 Avaya Aura SIP Enablement Services 5.2.1 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 5.2 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 4.0 Avaya Aura Communication Manager 5.2 Avaya Aura Communication Manager 5.1 Avaya Aura Application Enablement Services 4.2.2 Avaya Aura Application Enablement Services 3.1.6 Avaya Aura Application Enablement Services 3.1.4 Avaya Aura Application Enablement Services 3.1.3 Avaya Aura Application Enablement Services 5.2 Avaya Aura Application Enablement Services 4.2 Avaya Aura Application Enablement Services 4.0 Avaya Aura Application Enablement Services 3.1

Not Vulnerable:	Sun OpenSolaris build snv_133 QNX RTOS 6.4.2 NTP NTP 4.2.4 p8 Juniper IDP 5.1r4 Juniper CTPOS 6.6R2

Discussion

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability

NTP is prone to a remote denial-of-service vulnerability because it fails to properly handle certain incoming network packets.

An attacker can exploit this issue to cause the application to consume excessive CPU resources and fill disk space with log messages.

Exploit / POC

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability

A Metasploit Framework exploit module is available.

Solution / Fix

NTP mode 7 MODE_PRIVATE Packet Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu Ubuntu Linux 8.10 powerpc