Summary

CVE-2023-26551
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. 
An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Base Score:  5.6 MEDIUM
Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE-2023-26552
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. 
An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Base Score:  5.6 MEDIUM
Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE-2023-26553
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. 
An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Base Score:  5.6 MEDIUM
Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE-2023-26554
mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. 
An adversary may be able to attack a client ntpq process, but cannot attack ntpd.
Base Score:  5.6 MEDIUM
Vector:  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CVE-2023-26555
praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write.
Any attack method would be complex, e.g., with a manipulated GPS receiver.
Base Score:  6.4 MEDIUM
Vector:  CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Products Affected

Product Affected. All Brocade Fabric OS versions.

Products Confirmed Not Affected

• Brocade SANnav - vulnerable_code_not_in_execute_path

• Brocade ASCG - Vulnerable_code_not_in_execute_path

Solution

Security update is provided in Brocade Fabric OS v9.2.1, v9.2.0b, v9.1.1d, v8.2.3e and later releases.

Revision History

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.