- Arch-security - lists.archlinux.org

[arch-security] [ASA-201612-8] linux-zen: privilege escalation
by Levente Polyak 09 Dec '16

09 Dec '16

Arch Linux Security Advisory ASA-201612-8 ========================================= Severity: High Date : 2016-12-07 CVE-ID : CVE-2016-8655 Package : linux-zen Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-zen before version 4.8.12-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8.12-2. # pacman -Syu "linux-zen>=4.8.12-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== A race condition issue leading to a use-after-free flaw was found in the way the raw packet sockets implementation in the Linux kernel networking subsystem handled synchronization while creating the TPACKET_V3 ring buffer. A local user able to open a raw packet socket (requires the CAP_NET_RAW capability) could use this flaw to elevate their privileges on the system. Impact ====== A local attacker with CAP_NET_RAW capabilities is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-7] linux-lts: privilege escalation
by Levente Polyak 06 Dec '16

06 Dec '16

Arch Linux Security Advisory ASA-201612-7 ========================================= Severity: High Date : 2016-12-06 CVE-ID : CVE-2016-8655 Package : linux-lts Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-lts before version 4.4.36-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.4.36-1. # pacman -Syu "linux-lts>=4.4.36-1" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Impact ====== A local unprivileged attacker is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-6] linux: privilege escalation
by Levente Polyak 06 Dec '16

06 Dec '16

Arch Linux Security Advisory ASA-201612-6 ========================================= Severity: High Date : 2016-12-06 CVE-ID : CVE-2016-8655 Package : linux Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux before version 4.8.12-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 4.8.12-2. # pacman -Syu "linux>=4.8.12-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Impact ====== A local unprivileged attacker is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-5] linux-grsec: privilege escalation
by Levente Polyak 06 Dec '16

06 Dec '16

Arch Linux Security Advisory ASA-201612-5 ========================================= Severity: High Date : 2016-12-06 CVE-ID : CVE-2016-8655 Package : linux-grsec Type : privilege escalation Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package linux-grsec before version 1:4.8.12.r201612031658-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 1:4.8.12.r201612031658-2. # pacman -Syu "linux-grsec>=1:4.8.12.r201612031658-2" The problem has been fixed upstream but no release is available yet. Workaround ========== None. Description =========== Philip Pettersson discovered a race condition in the af_packet implementation in the Linux kernel. A local unprivileged attacker could use this to cause a denial of service (system crash) or run arbitrary code with administrative privileges. Impact ====== A local unprivileged attacker is able to crash the system or run arbitrary code with administrative privileges. References ========== https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=… http://seclists.org/oss-sec/2016/q4/607 https://access.redhat.com/security/cve/CVE-2016-8655

1 0

[arch-security] [ASA-201612-4] libdwarf: multiple issues
by Christian Rebischke 04 Dec '16

04 Dec '16

Arch Linux Security Advisory ASA-201612-4 ========================================= Severity: High Date : 2016-12-03 CVE-ID : CVE-2016-5027 CVE-2016-5028 CVE-2016-5029 CVE-2016-5030 CVE-2016-5031 CVE-2016-5032 CVE-2016-5033 CVE-2016-5035 CVE-2016-5037 CVE-2016-5040 CVE-2016-5041 CVE-2016-5043 CVE-2016-5044 CVE-2016-7510 CVE-2016-7511 CVE-2016-8679 CVE-2016-8680 CVE-2016-8681 CVE-2016-9275 CVE-2016-9276 CVE-2016-9480 CVE-2016-9558 Package : libdwarf Type : multiple issues Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package libdwarf before version 20161124-1 is vulnerable to multiple issues including arbitrary code execution, information disclosure and denial of service. Resolution ========== Upgrade to 20161124-1. # pacman -Syu "libdwarf>=20161124-1" The problems have been fixed upstream in version 20161124. Workaround ========== None. Description =========== - CVE-2016-5027 (denial of service) A vulnerability was found in libdwarf. A malicious object with data all-bits-on could bypass length checks which results in an out-of- bounds read. - CVE-2016-5028 (denial of service) A null pointer dereference vulnerability was found in libdwarf. It exists due to a corrupted object file. Libdwarf was not dealing with empty (bss-like) sections since it really did not expect to see such in sections it reads. - CVE-2016-5029 (denial of service) A null pointer dereference vulnerability was found in libdwarf in create_fullest_file_path() function. This is due to corrupted dwarf and the fix detects this corruption and if that null string pointer happens undetected a static string is substituted so readers can notice the situation. - CVE-2016-5030 (denial of service) A null pointer dereference vulnerability was found in libdwarf in _dwarf_calculate_info_section_end_ptr() function. - CVE-2016-5031 (information disclosure) An out-of-bounds read vulnerability was found in libdwarf in print_frame_inst_bytes() function. - CVE-2016-5032 (information disclosure) An out-of-bounds read vulnerability was found in libdwarf in dwarf_get_xu_hash_entry() function. - CVE-2016-5033 (information disclosure) An out-of-bounds read vulnerability was found in libdwarf in print_exprloc_content. - CVE-2016-5035 (information disclosure) An out-of-bounds read vulnerability was found in dwarf_line_table_reader.c. - CVE-2016-5037 (denial of service) A null pointer dereference vulnerability was found in _dwarf_load_section. - CVE-2016-5040 (denial of service) A vulnerability was found in libdwarf. If the data read for a compilation unit header contains a too large length value the library will read outside of its bounds and crash the application. - CVE-2016-5041 (denial of service) A vulnerability was found in libdwarf. If no DW_AT_name is present in a debugging information entry using DWARF5 macros a null dereference in dwarf_macro5.c will crash the application. - CVE-2016-5043 (information disclosure) A vulnerability was found in libdwarf. A function dwarf_dealloc() did not check the Dwarf_Ptr space argument before using it which leads to an out-of-bounds read. - CVE-2016-5044 (arbitrary code execution) A vulnerability was found in libdwarf in dwarf_elf_access.c:1071. A crafted ELF file may lead to a large offset value, which bigger than the size of target_section heap chunk, then this WRITE_UNALIGNED() function will write the value of &outval out of the heap chunk. The offset is a 64bit unsigned int value, so this is more than a heap overflow bug, but also a out-of-bound write bug. - CVE-2016-7510 (information disclosure) An out-of-bounds read vulnerability was found in read_line_table_program() in libdwarf. - CVE-2016-7511 (denial of service) An integer overflow vulnerability was found in dwarf_die_deliv.c causing segmentation fault. - CVE-2016-8679 (information disclosure) An out of bounds heap read vulnerability was found in _dwarf_get_size_of_val triggered by invoking dwarfdump command on crafted file. - CVE-2016-8680 (information disclosure) An out of bounds heap read vulnerability was found in _dwarf_get_abbrev_for_code triggered by invoking dwarfdump command on crafted file. - CVE-2016-8681 (information disclosure) An out of bounds heap read vulnerability was found in _dwarf_get_abbrev_for_code triggered by invoking dwarfdump command on crafted file. - CVE-2016-9275 (information disclosure) An out of bounds heap read was found in _dwarf_skim_forms in dwarf_macro5.c triggered by crafted input to dwarfdump utility. - CVE-2016-9276 (information disclosure) An out of bounds heap read was found in dwarf_get_aranges_list in dwarf_arrange.c triggered by crafted input to dwarfdump utility. - CVE-2016-9480 (information disclosure) libdwarf allows context-dependent attackers to obtain sensitive information or cause a denial of service by using the "malformed dwarf file" approach, related to a "Heap Buffer Over-read" issue affecting the dwarf_util.c component. - CVE-2016-9558 (denial of service) A negation overflow vulnerability was found in dwarf_leb.c triggered by crafted input to dwarfdump utility. Impact ====== An attacker could obtain sensitive information, execute arbitrary code or crash the application. References ========== https://blogs.gentoo.org/ago/2016/11/19/libdwarf-negation-overflow-in-dwarf… https://blogs.gentoo.org/ago/2016/11/07/libdwarf-heap-based-buffer-overflow… http://seclists.org/oss-sec/2016/q2/393 https://sourceforge.net/p/libdwarf/code/ci/a55b958926cc67f89a512ed30bb5a22b… https://sourceforge.net/p/libdwarf/code/ci/acae971371daa23a19358bc62204007d… https://sourceforge.net/p/libdwarf/code/ci/6fa3f710ee6f21bba7966b963033a91d… https://sourceforge.net/p/libdwarf/code/ci/ac6673e32f3443a5d36c2217cb814000… https://sourceforge.net/p/libdwarf/code/ci/82d8e007851805af0dcaaff41f49a2d4… https://sourceforge.net/p/libdwarf/code/ci/b6ec2dfd850929821626ea63fb0a7520… https://sourceforge.net/p/libdwarf/code/ci/98a3da1e8237fe0d45b67ef77f3fa5ed… https://sourceforge.net/p/libdwarf/bugs/3/ https://sourceforge.net/p/libdwarf/code/ci/2d14a7792889e33bc542c28d0f379296… https://sourceforge.net/p/libdwarf/code/ci/efe48cad0693d6994d9a7b561e1c3833… http://seclists.org/oss-sec/2016/q4/144 https://sourceforge.net/p/libdwarf/code/ci/268c1f18d1d28612af3b72d7c670076b… http://seclists.org/oss-sec/2016/q4/145 http://seclists.org/oss-sec/2016/q4/146 https://sourceforge.net/p/libdwarf/code/ci/583f8834083b5ef834c497f5b47797e1… http://seclists.org/oss-sec/2016/q4/401 https://github.com/asarubbo/poc/blob/master/00026-libdwarf-heapoverflow-dwa… https://sourceforge.net/p/libdwarf/code/ci/5dd64de047cd5ec479fb11fe7ff2692f… https://sourceforge.net/p/libdwarf/bugs/5/ https://www.prevanders.net/dwarfbug.html https://access.redhat.com/security/cve/CVE-2016-5027 https://access.redhat.com/security/cve/CVE-2016-5028 https://access.redhat.com/security/cve/CVE-2016-5029 https://access.redhat.com/security/cve/CVE-2016-5030 https://access.redhat.com/security/cve/CVE-2016-5031 https://access.redhat.com/security/cve/CVE-2016-5032 https://access.redhat.com/security/cve/CVE-2016-5033 https://access.redhat.com/security/cve/CVE-2016-5035 https://access.redhat.com/security/cve/CVE-2016-5037 https://access.redhat.com/security/cve/CVE-2016-5040 https://access.redhat.com/security/cve/CVE-2016-5041 https://access.redhat.com/security/cve/CVE-2016-5043 https://access.redhat.com/security/cve/CVE-2016-5044 https://access.redhat.com/security/cve/CVE-2016-7510 https://access.redhat.com/security/cve/CVE-2016-7511 https://access.redhat.com/security/cve/CVE-2016-8679 https://access.redhat.com/security/cve/CVE-2016-8680 https://access.redhat.com/security/cve/CVE-2016-8681 https://access.redhat.com/security/cve/CVE-2016-9275 https://access.redhat.com/security/cve/CVE-2016-9276 https://access.redhat.com/security/cve/CVE-2016-9480 https://access.redhat.com/security/cve/CVE-2016-9558

1 0

[arch-security] [ASA-201612-3] chromium: multiple issues
by Levente Polyak 04 Dec '16

04 Dec '16

Arch Linux Security Advisory ASA-201612-3 ========================================= Severity: Critical Date : 2016-12-03 CVE-ID : CVE-2016-5203 CVE-2016-5204 CVE-2016-5205 CVE-2016-5206 CVE-2016-5207 CVE-2016-5208 CVE-2016-5209 CVE-2016-5210 CVE-2016-5211 CVE-2016-5212 CVE-2016-5213 CVE-2016-5214 CVE-2016-5215 CVE-2016-5216 CVE-2016-5217 CVE-2016-5218 CVE-2016-5219 CVE-2016-5220 CVE-2016-5221 CVE-2016-5222 CVE-2016-5223 CVE-2016-5224 CVE-2016-5225 CVE-2016-5226 CVE-2016-9650 CVE-2016-9651 CVE-2016-9652 Package : chromium Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package chromium before version 55.0.2883.75-1 is vulnerable to multiple issues including arbitrary code execution, access restriction bypass, arbitrary filesystem access, cross-site scripting, same-origin policy bypass, content spoofing, insufficient validation and information disclosure. Resolution ========== Upgrade to 55.0.2883.75-1. # pacman -Syu "chromium>=55.0.2883.75-1" The problems have been fixed upstream in version 55.0.2883.75. Workaround ========== None. Description =========== - CVE-2016-5203 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5204 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5205 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5206 (same-origin policy bypass) A same-origin bypass flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5207 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5208 (cross-site scripting) An universal XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-5209 (arbitrary code execution) An out of bounds write flaw was found in the Blink component of the Chromium browser. - CVE-2016-5210 (arbitrary code execution) An out of bounds write flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5211 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5212 (arbitrary filesystem access) A local file disclosure flaw was found in the DevTools component of the Chromium browser. - CVE-2016-5213 (arbitrary code execution) An use after free flaw was found in the V8 component of the Chromium browser. - CVE-2016-5214 (insufficient validation) A file download protection bypass was discovered in the Chromium browser. - CVE-2016-5215 (arbitrary code execution) An use after free flaw was found in the Webaudio component of the Chromium browser. - CVE-2016-5216 (arbitrary code execution) An use after free flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5217 (insufficient validation) An use of unvalidated data flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5218 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2016-5219 (arbitrary code execution) An use after free flaw was found in the V8 component of the Chromium browser. - CVE-2016-5220 (arbitrary filesystem access) A local file access flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5221 (arbitrary code execution) An integer overflow flaw was found in the ANGLE component of the Chromium browser. - CVE-2016-5222 (content spoofing) An address spoofing flaw was found in the Omnibox component of the Chromium browser. - CVE-2016-5223 (arbitrary code execution) An integer overflow flaw was found in the PDFium component of the Chromium browser. - CVE-2016-5224 (same-origin policy bypass) A same-origin bypass flaw was found in the SVG component of the Chromium browser. - CVE-2016-5225 (access restriction bypass) A CSP bypass flaw was found in the Blink component of the Chromium browser. - CVE-2016-5226 (cross-site scripting) A limited XSS flaw was found in the Blink component of the Chromium browser. - CVE-2016-9650 (information disclosure) A CSP referrer disclosure vulnerability has been discovered in the Chromium browser. - CVE-2016-9651 (access restriction bypass) A private property access flaw was found in the V8 component of the Chromium browser. - CVE-2016-9652 (arbitrary code execution) Various fixes from internal audits, fuzzing and other initiatives. Impact ====== A remote attacker can bypass various restrictions, access sensitive information, spoof certain content or execute arbitrary code on the affected host. References ========== https://googlechromereleases.blogspot.fr/2016/12/stable-channel-update-for-… https://access.redhat.com/security/cve/CVE-2016-5203 https://access.redhat.com/security/cve/CVE-2016-5204 https://access.redhat.com/security/cve/CVE-2016-5205 https://access.redhat.com/security/cve/CVE-2016-5206 https://access.redhat.com/security/cve/CVE-2016-5207 https://access.redhat.com/security/cve/CVE-2016-5208 https://access.redhat.com/security/cve/CVE-2016-5209 https://access.redhat.com/security/cve/CVE-2016-5210 https://access.redhat.com/security/cve/CVE-2016-5211 https://access.redhat.com/security/cve/CVE-2016-5212 https://access.redhat.com/security/cve/CVE-2016-5213 https://access.redhat.com/security/cve/CVE-2016-5214 https://access.redhat.com/security/cve/CVE-2016-5215 https://access.redhat.com/security/cve/CVE-2016-5216 https://access.redhat.com/security/cve/CVE-2016-5217 https://access.redhat.com/security/cve/CVE-2016-5218 https://access.redhat.com/security/cve/CVE-2016-5219 https://access.redhat.com/security/cve/CVE-2016-5220 https://access.redhat.com/security/cve/CVE-2016-5221 https://access.redhat.com/security/cve/CVE-2016-5222 https://access.redhat.com/security/cve/CVE-2016-5223 https://access.redhat.com/security/cve/CVE-2016-5224 https://access.redhat.com/security/cve/CVE-2016-5225 https://access.redhat.com/security/cve/CVE-2016-5226 https://access.redhat.com/security/cve/CVE-2016-9650 https://access.redhat.com/security/cve/CVE-2016-9651 https://access.redhat.com/security/cve/CVE-2016-9652

1 0

[arch-security] [ASA-201612-2] thunderbird: arbitrary code execution
by Santiago Torres-Arias 01 Dec '16

01 Dec '16

Arch Linux Security Advisory ASA-201612-2 ========================================= Severity: Critical Date : 2016-12-01 CVE-ID : CVE-2016-9079 Package : thunderbird Type : arbitrary code execution Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package thunderbird before version 45.5.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 45.5.1-1. # pacman -Syu "thunderbird>=45.5.1-1" The problem has been fixed upstream in version 45.5.1. Workaround ========== None Description =========== A use-after-free vulnerability has been discovered in the SVG Animation component of Firefox, leading to arbitrary code execution. Impact ====== A remote attacker is able to execute arbitrary code by embedding a crafted SVG image in content displayed by Thunderbird. References ========== https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#t… https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/ https://access.redhat.com/security/cve/CVE-2016-9079

1 0

[arch-security] [ASA-201612-1] firefox: multiple issues
by Remi Gacogne 01 Dec '16

01 Dec '16

Arch Linux Security Advisory ASA-201612-1 ========================================= Severity: Critical Date : 2016-12-01 CVE-ID : CVE-2016-9078 CVE-2016-9079 Package : firefox Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package firefox before version 50.0.2-1 is vulnerable to multiple issues including arbitrary code execution and same-origin policy bypass. Resolution ========== Upgrade to 50.0.2-1. # pacman -Syu "firefox>=50.0.2-1" The problems have been fixed upstream in version 50.0.2. Workaround ========== None. Description =========== - CVE-2016-9078 (same-origin policy bypass) Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL in some circumstances. This can result in same-origin violations against a domain if it loads resources from malicious sites. Cross-origin setting of cookies has been demonstrated without the ability to read them. - CVE-2016-9079 (arbitrary code execution) A use-after-free vulnerability has been discovered in the SVG Animation component of Firefox, leading to arbitrary code execution. Impact ====== A remote attacker can bypass the same-origin policy and execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2016-91/ https://www.mozilla.org/en-US/security/advisories/mfsa2016-92/ https://access.redhat.com/security/cve/CVE-2016-9078 https://access.redhat.com/security/cve/CVE-2016-9079

1 0

[arch-security] [ASA-201611-29] neovim: arbitrary command execution
by Levente Polyak 29 Nov '16

29 Nov '16

Arch Linux Security Advisory ASA-201611-29 ========================================== Severity: High Date : 2016-11-29 CVE-ID : CVE-2016-1248 Package : neovim Type : arbitrary command execution Remote : No Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package neovim before version 0.1.7-1 is vulnerable to arbitrary command execution. Resolution ========== Upgrade to 0.1.7-1. # pacman -Syu "neovim>=0.1.7-1" The problem has been fixed upstream in version 0.1.7. Workaround ========== None. Description =========== A vulnerability has been discovered in vim which would allow arbitrary shell commands to be run if a user opened a file with a malicious modeline. This is due to lack of validation of values for a few options. Those options' values are then used in vim's scripts to build a command string that's evaluated by execute, which is what allows the shell commands to be run. This has been fixed in Vim by patch 8.0.0056. Since Neovim shares this code, it is also vulnerable. Impact ====== An attacker is able to execute arbitrary commands by tricking a user to open a malicious file with a special modeline. References ========== https://bugs.archlinux.org/task/51927 https://github.com/vim/vim/commit/d0b5138ba4bccff8a744c99836041ef6322ed39a https://github.com/neovim/neovim/commit/4fad66fbe637818b6b3d6bc5d21923ba727… https://access.redhat.com/security/cve/CVE-2016-1248

1 0

[arch-security] [ASA-201611-28] ntp: multiple issues
by Santiago Torres-Arias 26 Nov '16

26 Nov '16

Arch Linux Security Advisory ASA-201611-28 ========================================== Severity: High Date : 2016-11-26 CVE-ID : CVE-2016-7426 CVE-2016-7427 CVE-2016-7428 CVE-2016-7429 CVE-2016-7431 CVE-2016-7433 CVE-2016-7434 CVE-2016-9310 CVE-2016-9311 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p9-1 is vulnerable to multiple issues including denial of service, insufficient validation and incorrect calculation. Resolution ========== Upgrade to 4.2.8.p9-1. # pacman -Syu "ntp>=4.2.8.p9-1" The problems have been fixed upstream in version 4.2.8.p9. Workaround ========== A partial fix to some of the issues is to implement BCP-38, use "restrict default noquery ..." in your ntp.conf file and only allow mode 6 queries from trusted networks and hosts. Description =========== - CVE-2016-7426 (denial of service) When ntpd is configured with rate limiting for all associations (restrict default limited in ntp.conf), the limits are applied also to responses received from its configured sources. An attacker who knows the sources (e.g., from an IPv4 refid in server response) and knows the system is (mis)configured in this way can periodically send packets with spoofed source address to keep the rate limiting activated and prevent ntpd from accepting valid responses from its sources. - CVE-2016-7427 (denial of service) The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability in ntpd's broadcast mode replay prevention functionality can be abused. An attacker with access to the NTP broadcast domain can periodically inject specially crafted broadcast mode NTP packets into the broadcast domain which, while being logged by ntpd, can cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. - CVE-2016-7428 (denial of service) The broadcast mode of NTP is expected to only be used in a trusted network. If the broadcast network is accessible to an attacker, a potentially exploitable denial of service vulnerability in ntpd's broadcast mode poll interval enforcement functionality can be abused. To limit abuse, ntpd restricts the rate at which each broadcast association will process incoming packets. ntpd will reject broadcast mode packets that arrive before the poll interval specified in the preceding broadcast packet expires. An attacker with access to the NTP broadcast domain can send specially crafted broadcast mode NTP packets to the broadcast domain which, while being logged by ntpd, will cause ntpd to reject broadcast mode packets from legitimate NTP broadcast servers. - CVE-2016-7429 (denial of service) When ntpd receives a server response on a socket that corresponds to a different interface than was used for the request, the peer structure is updated to use the interface for new requests. If ntpd is running on a host with multiple interfaces in separate networks and the operating system doesn't check source address in received packets (e.g. rp_filter on Linux is set to 0), an attacker that knows the address of the source can send a packet with spoofed source address which will cause ntpd to select wrong interface for the source and prevent it from sending new requests until the list of interfaces is refreshed, which happens on routing changes or every 5 minutes by default. If the attack is repeated often enough (once per second), ntpd will not be able to synchronize with the source. - CVE-2016-7431 (insufficient validation) Zero Origin timestamp problems were fixed by Bug 2945 in ntp-4.2.8p6. However, subsequent timestamp validation checks introduced a regression in the handling of some Zero origin timestamp checks. - CVE-2016-7433 (incorrect calculation) ntpd Bug 2085 described a condition where the root delay was included twice, causing the jitter value to be higher than expected. Due to a misinterpretation of a small-print variable in The Book, the fix for this problem was incorrect, resulting in a root distance that did not include the peer dispersion. The calculations and formula have been reviewed and reconciled, and the code has been updated accordingly. - CVE-2016-7434 (denial of service) If ntpd is configured to allow mrulist query requests from a server that sends a crafted malicious packet, ntpd will crash on receipt of that crafted malicious mrulist query packet. - CVE-2016-9310 (denial of service) An exploitable configuration modification vulnerability exists in the control mode (mode 6) functionality of ntpd. If, against long-standing BCP recommendations, "restrict default noquery ..." is not specified, a specially crafted control mode packet can set ntpd traps, providing information disclosure and DDoS amplification, and unset ntpd traps, disabling legitimate monitoring. A remote, unauthenticated, network attacker can trigger this vulnerability. - CVE-2016-9311 (denial of service) ntpd does not enable trap service by default. If trap service has been explicitly enabled, an attacker can send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. Impact ====== A remote unauthenticated attacker may be able to perform a denial of service attack on ntpd via multiple vectors. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#November_2016_ntp_4_2_8… http://www.kb.cert.org/vuls/id/633847 http://support.ntp.org/bin/view/Main/NtpBug3071 http://support.ntp.org/bin/view/Main/NtpBug3114 http://support.ntp.org/bin/view/Main/NtpBug3113 http://support.ntp.org/bin/view/Main/NtpBug3072 http://support.ntp.org/bin/view/Main/NtpBug3102 http://support.ntp.org/bin/view/Main/NtpBug3067 http://bugs.ntp.org/show_bug.cgi?id=2085 http://support.ntp.org/bin/view/Main/NtpBug3082 http://support.ntp.org/bin/view/Main/NtpBug3118 http://support.ntp.org/bin/view/Main/NtpBug3119 https://access.redhat.com/security/cve/CVE-2016-7426 https://access.redhat.com/security/cve/CVE-2016-7427 https://access.redhat.com/security/cve/CVE-2016-7428 https://access.redhat.com/security/cve/CVE-2016-7429 https://access.redhat.com/security/cve/CVE-2016-7431 https://access.redhat.com/security/cve/CVE-2016-7433 https://access.redhat.com/security/cve/CVE-2016-7434 https://access.redhat.com/security/cve/CVE-2016-9310 https://access.redhat.com/security/cve/CVE-2016-9311

1 0