Windows NTP Time Server Syslog Monitor 1.0.000 Denial of Service Vulnerability
[--Vulnerability Summary--]
Title: Windows NTP Time Server Syslog Monitor 1.0.000 Denial of Service
Vulnerability
Product: Windows NTP Time Server Syslog Monitor 1.0.000
Discovered: November 29, 2008
Discovered by: Rob Kraus, princeofnigeria (PoN)
Vendor: TimeTools
Vendor URL: http://www.timetools.co.uk
Vendor notification date: December 1, 2008
Vendor response date: --
Vendor acknowledgment:--
Vendor provided fix:--
Release coordinated with the vendor: --
Public disclosure date: January 14, 2009
Affects: Windows NTP Time Server Syslog Monitor 1.0.000
Fixed in: No fix currently available.
Risk: High
Vulnerability Description: Windows NTP Time Server Syslog Monitor 1.0.000 is
vulnerable to a remote denial-of-service vulnerability because it fails to
handle user-supplied input. Sending a specially crafted UDP Syslog request will
cause the application to become unstable and stop responding.
Impact: A remote or local attacker can exploit this flaw by sending a specially
crafted packet to the Syslog server. Successful exploitation of this flaw will
cause the Syslog server process to crash preventing valid users or devices from
using the service. The Syslog server will need to be restarted to resume normal
Syslog server operations.
Keywords: security, vulnerability, syslog, princeofnigeria, windows, server,
udp, dos, denial of service
[--Background--]
Type of vulnerability: Input validation flaw
Who can exploit it: Local or Remote users
Windows NTP Time Server Syslog Monitor 1.0.000 is an application that provides
services for receiving system event messages to provide a centralized reporting
interface for distributed system events. The application should validate and
sanitize all user input to prevent unexpected conditions.
Per software download sites description: ?TimeTools Windows Atomic Clock NTP
Server Syslog Daemon is a free utility that runs on any Windows NT/2000/XP/2003
workstation or server. It allows any syslog messages from any Linux or Unix
based syslog client to be logged and displayed.?
Vulnerability Scope: The default installation of Windows NTP Time Server Syslog
Monitor 1.0.000 will allow exploitation of this vulnerability.
[--More Details--]
Exploitation of this flaw can be executed by sending a specially crafted UDP to
the target server. No exploit code is required.
[--Fix or Workaround Information--]
Patch availability: None
Vendor provided fix: None
Workarounds: None available at this time, design flaw. Discontinue use of this
product until a stable patch is released.
[--Disclosure Policy--]
PrinceofNigeria.org Vulnerability Disclosure Policy
http://www.princeofnigeria.org/blogs/index.php/vulndev/vulnreleasepolicy/?blog=1
[--Disclosure History--]
Public disclosure date: January 14, 2009
[--References--]
CVE-ID:
Bugtraq ID:
Secunia ID:
OSVDB ID:
[--Author--]
Rob Kraus, princeofnigeria (PoN)
Website: www.princeofnigeria.org/blogs