[--Vulnerability Summary--] Title: Windows NTP Time Server Syslog Monitor 1.0.000 Denial of Service Vulnerability Product: Windows NTP Time Server Syslog Monitor 1.0.000 Discovered: November 29, 2008 Discovered by: Rob Kraus, princeofnigeria (PoN) Vendor: TimeTools Vendor URL: http://www.timetools.co.uk Vendor notification date: December 1, 2008 Vendor response date: -- Vendor acknowledgment:-- Vendor provided fix:-- Release coordinated with the vendor: -- Public disclosure date: January 14, 2009 Affects: Windows NTP Time Server Syslog Monitor 1.0.000 Fixed in: No fix currently available. Risk: High Vulnerability Description: Windows NTP Time Server Syslog Monitor 1.0.000 is vulnerable to a remote denial-of-service vulnerability because it fails to handle user-supplied input. Sending a specially crafted UDP Syslog request will cause the application to become unstable and stop responding. Impact: A remote or local attacker can exploit this flaw by sending a specially crafted packet to the Syslog server. Successful exploitation of this flaw will cause the Syslog server process to crash preventing valid users or devices from using the service. The Syslog server will need to be restarted to resume normal Syslog server operations. Keywords: security, vulnerability, syslog, princeofnigeria, windows, server, udp, dos, denial of service [--Background--] Type of vulnerability: Input validation flaw Who can exploit it: Local or Remote users Windows NTP Time Server Syslog Monitor 1.0.000 is an application that provides services for receiving system event messages to provide a centralized reporting interface for distributed system events. The application should validate and sanitize all user input to prevent unexpected conditions. Per software download sites description: ?TimeTools Windows Atomic Clock NTP Server Syslog Daemon is a free utility that runs on any Windows NT/2000/XP/2003 workstation or server. It allows any syslog messages from any Linux or Unix based syslog client to be logged and displayed.? Vulnerability Scope: The default installation of Windows NTP Time Server Syslog Monitor 1.0.000 will allow exploitation of this vulnerability. [--More Details--] Exploitation of this flaw can be executed by sending a specially crafted UDP to the target server. No exploit code is required. [--Fix or Workaround Information--] Patch availability: None Vendor provided fix: None Workarounds: None available at this time, design flaw. Discontinue use of this product until a stable patch is released. [--Disclosure Policy--] PrinceofNigeria.org Vulnerability Disclosure Policy http://www.princeofnigeria.org/blogs/index.php/vulndev/vulnreleasepolicy/?blog=1 [--Disclosure History--] Public disclosure date: January 14, 2009 [--References--] CVE-ID: Bugtraq ID: Secunia ID: OSVDB ID: [--Author--] Rob Kraus, princeofnigeria (PoN) Website: www.princeofnigeria.org/blogs
