[Sec 3505] CVE-2018-12327 - Arbitrary Code Execution Vulnerability

bk: 5b3ba863G-42Ac2TFzCy-PZ8vqNfVA

diff --git a/ChangeLog b/ChangeLog
index 25bb8f0822355b0e64e235d115a29c650e2d4bd4..cbc6942bbbee508095cbc6ec610e5885266f839d 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 ---
 
+* [Sec 3505] CVE-2018-12327 - Arbitrary Code Execution Vulnerability
+  - fixed stack buffer overflow in NTPQ/NTPDC <perlinger@ntp.org>
 * [Bug 3486] Buffer overflow in ntpq/ntpq.c:tstflags() <perlinger@ntp.org>
   - applied patch by Gerry Garvey
 * [Bug 3485] Undefined sockaddr used in error messages in ntp_config.c <perlinger@ntp.org>

diff --git a/ntpdc/ntpdc.c b/ntpdc/ntpdc.c
index af3694d46376373bfcf3e544eb21af0d44ecb1d3..c54596e32f9476a06007cf16cf35f96c5545edfa 100644 (file)
--- a/ntpdc/ntpdc.c
+++ b/ntpdc/ntpdc.c
@@ -404,31 +404,28 @@ openhost(
        )
 {
        char temphost[LENHOSTNAME];
-       int a_info, i;
+       int a_info;
        struct addrinfo hints, *ai = NULL;
        sockaddr_u addr;
        size_t octets;
-       register const char *cp;
+       const char *cp;
        char name[LENHOSTNAME];
        char service[5];
 
        /*
         * We need to get by the [] if they were entered 
         */
-       
-       cp = hname;
-       
-       if (*cp == '[') {
-               cp++;   
-               for (i = 0; *cp && *cp != ']'; cp++, i++)
-                       name[i] = *cp;
-               if (*cp == ']') {
-                       name[i] = '\0';
-                       hname = name;
-               } else {
+       if (*hname == '[') {
+               cp = strchr(hname + 1, ']');
+               if (!cp || (octets = (size_t)(cp - hname) - 1) >= sizeof(name)) {
+                       errno = EINVAL;
+                       warning("%s", "bad hostname/address");
                        return 0;
                }
-       }       
+               memcpy(name, hname + 1, octets);
+               name[octets] = '\0';
+               hname = name;
+       }
 
        /*
         * First try to resolve it as an ip address and if that fails,

diff --git a/ntpq/ntpq.c b/ntpq/ntpq.c
index bda9b560294218c27ede82ad92c10dbd555a4082..4b9210392766be93d571b56755b5a5da2b86e8f2 100644 (file)
--- a/ntpq/ntpq.c
+++ b/ntpq/ntpq.c
@@ -654,29 +654,26 @@ openhost(
 {
        const char svc[] = "ntp";
        char temphost[LENHOSTNAME];
-       int a_info, i;
+       int a_info;
        struct addrinfo hints, *ai;
        sockaddr_u addr;
        size_t octets;
-       register const char *cp;
+       const char *cp;
        char name[LENHOSTNAME];
 
        /*
         * We need to get by the [] if they were entered
         */
-
-       cp = hname;
-
-       if (*cp == '[') {
-               cp++;
-               for (i = 0; *cp && *cp != ']'; cp++, i++)
-                       name[i] = *cp;
-               if (*cp == ']') {
-                       name[i] = '\0';
-                       hname = name;
-               } else {
+       if (*hname == '[') {
+               cp = strchr(hname + 1, ']');
+               if (!cp || (octets = (size_t)(cp - hname) - 1) >= sizeof(name)) {
+                       errno = EINVAL;
+                       warning("%s", "bad hostname/address");
                        return 0;
                }
+               memcpy(name, hname + 1, octets);
+               name[octets] = '\0';
+               hname = name;
        }
 
        /*