Stay Secure with the Latest Linux Advisories

security advisoryremote accessmedium severity

Arch Linux 2016: ASA-201601-19 Medium Severity: NTP Time Alteration

The package ntp before version 4.2.8.p5-1 is vulnerable to time alteration. . Arch Linux Security Advisory ASA-201601-19 ========================================= Severity: Medium Date : 2016-01-17 CVE-ID : CVE-2015-5300 Package : ntp Type : time alteration Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package ntp before version 4.2.8.p5-1 is vulnerable to time alteration. Resolution ========= Upgrade to 4.2.8.p5-1. # pacman -Syu "ntp> =4.2.8.p5-1" The problem has been fixed upstream in version 4.2.8.p5. Workaround ========= Removing -g from the ntpd startup options limits the time modification to 900s per attack. This can be done by editing the ExecStart line of the /usr/lib/systemd/system/ntpd.service file to remove the -g option, then issuing: # systemctl daemon-reload # systemctl restart ntpd Description ========== If ntpd is always started with the -g option, which is common and against long-standing recommendation, and if at the moment ntpd is restarted an attacker can immediately respond to enough requests from enough sources trusted by the target, which is difficult and not common, there is a window of opportunity where the attacker can cause ntpd to set the time to an arbitrary value. Similarly, if an attacker is able to respond to enough requests from enough sources trusted by the target, the attacker can cause ntpd to abort and restart, at which point it can tell the target to set the time to an arbitrary value if and only if ntpd was re-started against long-standing recommendation with the -g flag, or if ntpd was not given the -g flag, the attacker can move the target system's time by at most 900 seconds' time per attack. Impact ===== As the ntpd default startup options on Arch contain -g, a remote attacker might be able to alter the system time to an arbitrary value, bypassing checks based on the time, like for example X.509 certificates expirationdates. References ========= https://access.redhat.com/security/cve/CVE-2015-5300 http://www.ntp.org/support/securitynotice/ntpbug2956/ https://www.cs.bu.edu/~goldbe/NTPattack.html . Arch Linux Security Bulletin on NTP time modification flaw specifics medium risk CVE-2015-5300 remedy and enhancements.. Arch Linux, NTP Patch, Time Attack, Medium Severity. . Severity: Medium. LinuxSecurity.com Team

Jan 17, 2016 •Medium ArchLinux