Talos Vulnerability Report

Description

A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability.

Tested Versions

ntp 4.2.8p2

Product URLs

http://www.ntp.org

Details

The function save_config in the file ntp_control.c will perform path sanitization by stripping out ‘\’ and ‘/’ from the filename provided to ensure that a user does not save files outside of the saveconfigdir that was previously configured.

if (strchr(filename, '\\') || strchr(filename, '/')) {
        snprintf(reply, sizeof(reply),
             "saveconfig does not allow directory in filename");
        ctl_putdata(reply, strlen(reply), 0);
        ctl_flushpkt(0);
        msyslog(LOG_NOTICE,
            "saveconfig with path from %s rejected",
            stoa(&rbufp->recv_srcadr));
        return;
    }

However on operating systems such as OpenVMS, directory separation is not done by using ‘\’ or ‘/’ but instead by characters such as ‘.’, ’-‘ and ‘:’.