ArchLinux: 201510-14: ntp: multiple issues
Summary
- CVE-2015-7871 (authentication bypass)
An error handling logic error exists within ntpd that manifests due to improper
error condition handling associated with certain crypto-NAK packets. An
unauthenticated, off-path attacker can force ntpd processes on targeted servers
to peer with time sources of the attacker's choosing by transmitting symmetric
active crypto-NAK packets to ntpd. This attack bypasses the authentication
typically required to establish a peer association and allows an attacker to
make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is
credited with discovering this vulnerability. [1]
- CVE-2015-7855 (denial of service)
decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values.
This can cause a denial of service.
- CVE-2015-7854 (memory corruption)
A potential buffer overflow vulnerability exists in the password management
functionality of ntp. A specially crafted key file could cause a buffer overflow
potentially resulting in memory being modified. An attacker could provide a
malicious password to trigger this vulnerability. [2]
- CVE-2015-7849 (memory corruption)
An exploitable use-after-free vulnerability exists in the password management
functionality of the Network Time Protocol. A specially crafted key file could
cause a buffer overflow resulting in memory corruption. An attacker could
provide a malicious password file to trigger this vulnerability. [3]
- CVE-2015-7852 (memory corruption)
A potential off by one vulnerability exists in the cookedprint functionality of
ntpq. A specially crafted buffer could cause a buffer overflow potentially
resulting in null byte being written out of bounds. [4]
- CVE-2015-7853 (memory corruption)
A potential buffer overflow vulnerability exists in the refclock of ntpd. An
invalid length provided by a hardware reference clock could cause a buffer
overflow potentially resulting in memory being modified. A malicious reflock
could provide a negative length to trigger this vulnerability. [5]
- CVE-2015-7848 (denial of service)
When processing a specially crafted private mode packet, an integer overflow can
occur leading to out of bounds memory copy operation. The crafted packet needs
to have the correct message authentication code and a valid timestamp. When
processed by the NTP daemon, it leads to an immediate crash. [6]
- CVE-2015-7850 (denial of service)
An exploitable denial of service vulnerability exists in the remote
configuration functionality of the Network Time Protocol. A specially crafted
configuration file could cause an endless loop resulting in a denial of service.
An attacker could provide a the malicious configuration file to trigger this
vulnerability. [7]
- CVE-2015-7851 (directory traversal)
A potential path traversal vulnerability exists in the config file saving of
ntpd on VMS. A specially crafted path could cause a path traversal potentially
resulting in files being overwritten. An attacker could provide a malicious path
to trigger this vulnerability. [8]
- CVE-2015-7701 (memory leak)
Slow memory leak in CRYPTO_ASSOC.
- CVE-2015-7702 (denial of service).
Incomplete autokey data packet length checks.
- CVE-2015-7703 (directory traversal)
configuration directives "pidfile" and "driftfile" should only be allowed
locally.
- CVE-2015-7704 (denial of service)
Clients that receive a KoD should validate the origin timestamp field.
- CVE-2015-7705 (denial of service)
Clients that receive a KoD should validate the origin timestamp field.
- CVE-2015-7691 (denial of service)
Incomplete autokey data packet length checks.
- CVE-2015-7692 (denial of service
Incomplete autokey data packet length checks.
Resolution
Upgrade to 4.2.8.p4-1.
# pacman -Syu "ntp>=4.2.8.p4-1"
The problems have been fixed upstream in version 4.2.8.p4.
References
https://www.ntp.org/support/securitynotice/ https://blog.talosintelligence.com/ntpd-vulnerabilities/ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7691 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7692 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7701 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7702 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7703 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7704 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7705 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7848 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7849 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7850 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7851 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7852 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7853 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7854 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7855 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7871 [1] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0069/ [2] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0065/ [3] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0054/ [4] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0063/ [5] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0064/ [6] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0052/ [7] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0055/ [8] https://talosintelligence.com/vulnerability_reports/TALOS-2015-0062/
Workaround
None.
