Discover Government News

Arch Linux Security Advisory ASA-201601-19
=========================================
Severity: Medium
Date    : 2016-01-17
CVE-ID  : CVE-2015-5300
Package : ntp
Type    : time alteration
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package ntp before version 4.2.8.p5-1 is vulnerable to time alteration.

Resolution
=========
Upgrade to 4.2.8.p5-1.

# pacman -Syu "ntp>=4.2.8.p5-1"

The problem has been fixed upstream in version 4.2.8.p5.

Workaround
=========
Removing -g from the ntpd startup options limits the time modification
to 900s per attack.
This can be done by editing the ExecStart line of the
/usr/lib/systemd/system/ntpd.service file to remove the -g option, then
issuing:

# systemctl daemon-reload
# systemctl restart ntpd

Description
==========
If ntpd is always started with the -g option, which is common and
against long-standing recommendation, and if at the moment ntpd is
restarted an attacker can immediately respond to enough requests from
enough sources trusted by the target, which is difficult and not common,
there is a window of opportunity where the attacker can cause ntpd to
set the time to an arbitrary value.
Similarly, if an attacker is able to respond to enough requests from
enough sources trusted by the target, the attacker can cause ntpd to
abort and restart, at which point it can tell the target to set the time
to an arbitrary value if and only if ntpd was re-started against
long-standing recommendation with the -g flag, or if ntpd was not given
the -g flag, the attacker can move the target system's time by at most
900 seconds' time per attack.

Impact
=====
As the ntpd default startup options on Arch contain -g, a remote
attacker might be able to alter the system time to an arbitrary value,
bypassing checks based on the time, like for example X.509 certificates
expiration dates.

References
=========
https://access.redhat.com/security/cve/CVE-2015-5300
https://www.ntp.org/support/securitynotice/ntpbug2956/
https://www.cs.bu.edu/~goldbe/NTPattack.html

ArchLinux: 201601-19: ntp: time alteration

January 17, 2016

Summary

If ntpd is always started with the -g option, which is common and against long-standing recommendation, and if at the moment ntpd is restarted an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of opportunity where the attacker can cause ntpd to set the time to an arbitrary value. Similarly, if an attacker is able to respond to enough requests from enough sources trusted by the target, the attacker can cause ntpd to abort and restart, at which point it can tell the target to set the time to an arbitrary value if and only if ntpd was re-started against long-standing recommendation with the -g flag, or if ntpd was not given the -g flag, the attacker can move the target system's time by at most 900 seconds' time per attack.

Resolution

Upgrade to 4.2.8.p5-1. # pacman -Syu "ntp>=4.2.8.p5-1"
The problem has been fixed upstream in version 4.2.8.p5.

References

https://access.redhat.com/security/cve/CVE-2015-5300 https://www.ntp.org/support/securitynotice/ntpbug2956/ https://www.cs.bu.edu/~goldbe/NTPattack.html

Severity
Package : ntp
Type : time alteration
Remote : Yes
Link : https://wiki.archlinux.org/title/CVE

Workaround

Removing -g from the ntpd startup options limits the time modification to 900s per attack. This can be done by editing the ExecStart line of the /usr/lib/systemd/system/ntpd.service file to remove the -g option, then issuing: # systemctl daemon-reload # systemctl restart ntpd

Related News