Ubuntu 14.10 USN-2449-1 Critical: NTP Buffer Overflow and Spoofing

ubuntu

December 22, 2014

Several security issues were fixed in NTP.

Summary

Several security issues were fixed in NTP.

Software Description:

- ntp: Network Time Protocol daemon and utility programs

Details:

Neel Mehta discovered that NTP generated weak authentication keys. A remote

attacker could possibly use this issue to brute force the authentication

key and send requests if permitted by IP restrictions. (CVE-2014-9293)

Stephen Roettger discovered that NTP generated weak MD5 keys. A remote

attacker could possibly use this issue to brute force the MD5 key and spoof

a client or server. (CVE-2014-9294)

Stephen Roettger discovered that NTP contained buffer overflows in the

crypto_recv(), ctl_putdata() and configure() functions. In non-default

configurations, a remote attacker could use these issues to cause NTP to

crash, resulting in a denial of service, or possibly execute arbitrary

code. The default compiler options for affected releases should reduce the

vulnerability to a denial of service. In addition, attackers would be

isol...

Read the Full Advisory

Topics Covered

security advisory denial of service buffer overflow critical ubuntu ntp spoofing

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  ntp                             1:4.2.6.p5+dfsg-3ubuntu2.14.10.1

Ubuntu 14.04 LTS:
  ntp                             1:4.2.6.p5+dfsg-3ubuntu2.14.04.1

Ubuntu 12.04 LTS:
  ntp                             1:4.2.6.p3+dfsg-1ubuntu3.2

Ubuntu 10.04 LTS:
  ntp                             1:4.2.4p8+dfsg-1ubuntu2.2

After a standard system update you need to regenerate any MD5 keys that
were manually created with ntp-keygen.