emo/busybox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ntpd: respond only to client and symmetric active packets

Browse Source 
The busybox NTP implementation doesn't check the NTP mode of packets
received on the server port and responds to any packet with the right
size. This includes responses from another NTP server. An attacker can
send a packet with a spoofed source address in order to create an
infinite loop of responses between two busybox NTP servers. Adding
more packets to the loop increases the traffic between the servers
until one of them has a fully loaded CPU and/or network.

Signed-off-by: Miroslav Lichvar <mlichvar@redhat.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
This commit is contained in:
Miroslav Lichvar 2016-08-01 20:24:24 +02:00 committed by Denys Vlasenko
parent 6b5abc9596
commit 150dc7a2b4
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
networking/ntpd.c
View File

@ -2051,6 +2051,13 @@ recv_and_process_client_pkt(void /*int fd*/)
goto bail; goto bail;
} }
/* Respond only to client and symmetric active packets */
if ((msg.m_status & MODE_MASK) != MODE_CLIENT
&& (msg.m_status & MODE_MASK) != MODE_SYM_ACT
) {
goto bail;
}
query_status = msg.m_status; query_status = msg.m_status;
query_xmttime = msg.m_xmttime; query_xmttime = msg.m_xmttime;