CVE-2016-3962
published 2016-07-03CVE-2016-3962: Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600…
PriorityP356high7.3CVSS 3.0
AVNACLPRNUINSUCLILAL
EXPLOIT
EPSS
5.22%
91.5th percentile
Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| meinberg | ntp_server_firmware | <= 6.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit sends a crafted HTTP POST to /cgi-bin/main with a 'button' parameter padded with ~10028 bytes of 'A' characters followed by ROP chain gadgets — detect oversized POST bodies to this endpoint. ↗
- →The exploit stages a reverse shell via mkfifo on /tmp/foo and executes /bin/bash through it; monitor for creation of named pipes in /tmp and outbound connections from the NTP server process. ↗
- ·The ROP gadget addresses and buffer offsets in the exploit are specific to firmware version ELX800/GPS M4x V5.30p (Kernel 2.6.15.1, System Version 530, Lantime configuration utility 1.27); they will differ on other firmware versions. ↗
- ·The vulnerability affects all listed Meinberg products running firmware Version 6.0 and earlier; firmware 6.20.004 is the patched version. ↗
CVSS provenance
nvdv3.07.3HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wjmf-cvm2-jrwm: Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME
ghsa_unreviewed·2022-05-17
CVE-2016-3962 [HIGH] CWE-119 GHSA-wjmf-cvm2-jrwm: Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME
Stack-based buffer overflow in the NTP time-server interface on Meinberg IMS-LANTIME M3000, IMS-LANTIME M1000, IMS-LANTIME M500, LANTIME M900, LANTIME M600, LANTIME M400, LANTIME M300, LANTIME M200, LANTIME M100, SyncFire 1100, and LCES devices with firmware before 6.20.004 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via a crafted parameter in a POST request.
CISA ICS
Meinberg NTP Time Server Vulnerabilities
cisa_ics·2018-08-23
Meinberg NTP Time Server Vulnerabilities
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Meinberg NTP Time Server Vulnerabilities
Last RevisedAugust 23, 2018
Alert CodeICSA-16-175-03
## OVERVIEW
Independent researcher Ryan Wincey has identified a stack buffer overflow vulnerability and a privilege escalation vulnerability in Meinberg’s NTP Time Servers Interface. Meinberg has produced a new Version 6.20.004 to mitigate these vulnerabilities. The researcher has validated the firmware update. He confirms the update fixes these vulnerabilities.
These vulnerabilities could be exploited remotely.
## AFFECTED PRODUCTS
The following Meinberg products are affected:
- IM
No detection rules found.
No writeups or analysis indexed.
2016-07-03
Published