From owner-freebsd-bugs Mon Jun 15 12:50:53 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id MAA14413 for freebsd-bugs-outgoing; Mon, 15 Jun 1998 12:50:53 -0700 (PDT) (envelope-from owner-freebsd-bugs@FreeBSD.ORG) Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id MAA14404 for ; Mon, 15 Jun 1998 12:50:50 -0700 (PDT) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.8.8/8.8.5) id MAA21071; Mon, 15 Jun 1998 12:50:02 -0700 (PDT) Received: from red.juniper.net (red.juniper.net [208.197.169.254]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id MAA14060 for ; Mon, 15 Jun 1998 12:48:51 -0700 (PDT) (envelope-from dkatz@juniper.net) Received: from cirrus.juniper.net (cirrus.juniper.net [208.197.169.207]) by red.juniper.net (8.8.5/8.8.5) with ESMTP id MAA12561 for ; Mon, 15 Jun 1998 12:48:22 -0700 (PDT) Received: (from dkatz@localhost) by cirrus.juniper.net (8.8.7/8.7.3) id MAA15823; Mon, 15 Jun 1998 12:49:41 -0700 (PDT) Message-Id: <199806151949.MAA15823@cirrus.juniper.net> Date: Mon, 15 Jun 1998 12:49:41 -0700 (PDT) From: Dave Katz Reply-To: dkatz@juniper.net To: FreeBSD-gnats-submit@FreeBSD.ORG X-Send-Pr-Version: 3.2 Subject: misc/6959: Shouldn't allow destructive remote modification of NTP config Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Number: 6959 >Category: misc >Synopsis: Shouldn't allow destructive remote modification of NTP config >Confidential: yes >Severity: non-critical >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Jun 15 12:50:01 PDT 1998 >Last-Modified: >Originator: Dave Katz >Organization: >Release: FreeBSD 2.2.5-STABLE i386 >Environment: >Description: We shouldn't ever allow mode 6 or 7 commands to modify the NTP config; this should be done via the CLI only, as it is Yet Another Security Hole and the changes will be lost anyhow when xntpd restarts. >How-To-Repeat: >Fix: Don't allow request-key or control-key to be configured (remove from the DDL). Ensure that destructive request and control packets are not allowed if the local key is zero (I don't believe this is true for control packets; xntpdc won't send a packet with a nonzero key, but I think xntpd will accept them). >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message