BSA-2017-219

Brocade Fabric OS

2 more products

21546

31 March 2017

31 March 2017

Closed

Low

3.0

N/A

CVE-2016-9310

Summary

Security Advisory ID : BSA-2017-219

Component : ntp

Revision : 1.0: Interim

An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations, "restrict default noquery ..." is not specified, a specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, disabling legitimate monitoring. A remote, unauthenticated, network attacker can trigger this vulnerability.

Affected Products

Product Current Assessment
Brocade 5400 vRouter Impacted: Fixed in 6.7R13.
Brocade Services Director Impacted: Fixed in 17.1 and later.

Products Confirmed Not Vulnerable

Brocade Fabric OS, Brocade FastIron OS, Brocade NetIron OS, Brocade Network Advisor, Brocade Network OS, Brocade SDN Controller, Brocade ServerIron ADX, Brocade SLX-OS, Brocade Virtual ADX, BrocadeVirtual Traffic Manager: Software, and Brocade Virtual Web Application Firewall are confirmed not affected by this vulnerability.

Workaround

There are no workarounds that address this vulnerability.

Revision History

Version Change Date
1.0 Initial Publication March 31, 2017