Linux Security
    Linux Security
    Linux Security

    Debian: DSA-3388-1: ntp security update

    Date 01 Nov 2015
    Posted By LinuxSecurity Advisories
    Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs: CVE-2015-5146
    Hash: SHA256
    - -------------------------------------------------------------------------
    Debian Security Advisory DSA-3388-1                   This email address is being protected from spambots. You need JavaScript enabled to view it.                              Kurt Roeckx
    November 01, 2015           
    - -------------------------------------------------------------------------
    Package        : ntp
    CVE ID         : CVE-2014-9750 CVE-2014-9751 CVE-2015-3405 CVE-2015-5146 
                     CVE-2015-5194 CVE-2015-5195 CVE-2015-5219 CVE-2015-5300
                     CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702
                     CVE-2015-7703 CVE-2015-7704 CVE-2015-7850 CVE-2015-7852
                     CVE-2015-7855 CVE-2015-7871
    Several vulnerabilities were discovered in the Network Time Protocol
    daemon and utility programs:
       A flaw was found in the way ntpd processed certain remote
       configuration packets. An attacker could use a specially crafted
       package to cause ntpd to crash if:
       * ntpd enabled remote configuration
       * The attacker had the knowledge of the configuration password
       * The attacker had access to a computer entrusted to perform remote
       Note that remote configuration is disabled by default in NTP.
        It was found that ntpd could crash due to an uninitialized
        variable when processing malformed logconfig configuration
        It was found that ntpd exits with a segmentation fault when a
        statistics type that was not enabled during compilation (e.g.
        timingstats) is referenced by the statistics or filegen
        configuration command
        It was discovered that sntp program would hang in an infinite loop
        when a crafted NTP packet was received, related to the conversion
        of the precision value in the packet to double.
        It was found that ntpd did not correctly implement the -g option:
        Normally, ntpd exits with a message to the system log if the offset
        exceeds the panic threshold, which is 1000 s by default. This
        option allows the time to be set to any value without restriction;
        however, this can happen only once. If the threshold is exceeded
        after that, ntpd will exit with a message to the system log. This
        option can be used with the -q and -x options.
        ntpd could actually step the clock multiple times by more than the
        panic threshold if its clock discipline doesn't have enough time to
        reach the sync state and stay there for at least one update. If a
        man-in-the-middle attacker can control the NTP traffic since ntpd
        was started (or maybe up to 15-30 minutes after that), they can
        prevent the client from reaching the sync state and force it to step
        its clock by any amount any number of times, which can be used by
        attackers to expire certificates, etc.
        This is contrary to what the documentation says. Normally, the
        assumption is that an MITM attacker can step the clock more than the
        panic threshold only once when ntpd starts and to make a larger
        adjustment the attacker has to divide it into multiple smaller
        steps, each taking 15 minutes, which is slow.
    CVE-2015-7691, CVE-2015-7692, CVE-2015-7702
        It was found that the fix for CVE-2014-9750 was incomplete: three
        issues were found in the value length checks in ntp_crypto.c, where
        a packet with particular autokey operations that contained malicious
        data was not always being completely validated. Receipt of these
        packets can cause ntpd to crash.
        A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is
        configured to use autokey authentication, an attacker could send
        packets to ntpd that would, after several days of ongoing attack,
        cause it to run out of memory.
        Miroslav Lichvar of Red Hat found that the :config command can be
        used to set the pidfile and driftfile paths without any
        restrictions. A remote attacker could use this flaw to overwrite a
        file on the file system with a file containing the pid of the ntpd
        process (immediately) or the current estimated drift of the system
        clock (in hourly intervals). For example:
        ntpq -c ':config pidfile /tmp/'
        ntpq -c ':config driftfile /tmp/ntp.drift'
        In Debian ntpd is configured to drop root privileges, which limits
        the impact of this issue.
        If ntpd as an NTP client receives a Kiss-of-Death (KoD) packet
        from the server to reduce its polling rate, it doesn't check if the
        originate timestamp in the reply matches the transmit timestamp from
        its request. An off-path attacker can send a crafted KoD packet to
        the client, which will increase the client's polling interval to a
        large value and effectively disable synchronization with the server.
        An exploitable denial of service vulnerability exists in the remote
        configuration functionality of the Network Time Protocol. A
        specially crafted configuration file could cause an endless loop
        resulting in a denial of service.  An attacker could provide a the
        malicious configuration file to trigger this vulnerability.
        A potential off by one vulnerability exists in the cookedprint
        functionality of ntpq. A specially crafted buffer could cause a
        buffer overflow potentially resulting in null byte being written out
        of bounds.
        It was found that NTP's decodenetnum() would abort with an assertion
        failure when processing a mode 6 or mode 7 packet containing an
        unusually long data value where a network address was expected. This
        could allow an authenticated attacker to crash ntpd.
        An error handling logic error exists within ntpd that manifests due
        to improper error condition handling associated with certain
        crypto-NAK packets. An unauthenticated, off-path attacker can force
        ntpd processes on targeted servers to peer with time sources of the
        attacker's choosing by transmitting symmetric active crypto-NAK
        packets to ntpd. This attack bypasses the authentication typically
        required to establish a peer association and allows an attacker to
        make arbitrary changes to system time.
    For the oldstable distribution (wheezy), these problems have been fixed
    in version 1:4.2.6.p5+dfsg-2+deb7u6.
    For the stable distribution (jessie), these problems have been fixed in
    version 1:4.2.6.p5+dfsg-7+deb8u1.
    For the testing distribution (stretch), these problems have been fixed
    in version 1:4.2.8p4+dfsg-3.
    For the unstable distribution (sid), these problems have been fixed in
    version 1:4.2.8p4+dfsg-3.
    We recommend that you upgrade your ntp packages.
    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at:
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.


    LinuxSecurity Poll

    No results found.

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.