Arch Linux Security Advisory ASA-201510-14 ========================================== Severity: Critical Date : 2015-10-22 CVE-ID : CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703 CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850 CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855 CVE-2015-7871 Package : ntp Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The package ntp before version 4.2.8.p4-1 is vulnerable to multiple issues including denial of service, memory corruption, directory traversal, memory leaks and authentication bypass. Resolution ========== Upgrade to 4.2.8.p4-1. # pacman -Syu "ntp>=4.2.8.p4-1" The problems have been fixed upstream in version 4.2.8.p4. Workaround ========== None. Description =========== - CVE-2015-7871 (authentication bypass) An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is credited with discovering this vulnerability. [1] - CVE-2015-7855 (denial of service) decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values. This can cause a denial of service. - CVE-2015-7854 (memory corruption) A potential buffer overflow vulnerability exists in the password management functionality of ntp. A specially crafted key file could cause a buffer overflow potentially resulting in memory being modified. An attacker could provide a malicious password to trigger this vulnerability. [2] - CVE-2015-7849 (memory corruption) An exploitable use-after-free vulnerability exists in the password management functionality of the Network Time Protocol. A specially crafted key file could cause a buffer overflow resulting in memory corruption. An attacker could provide a malicious password file to trigger this vulnerability. [3] - CVE-2015-7852 (memory corruption) A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. [4] - CVE-2015-7853 (memory corruption) A potential buffer overflow vulnerability exists in the refclock of ntpd. An invalid length provided by a hardware reference clock could cause a buffer overflow potentially resulting in memory being modified. A malicious reflock could provide a negative length to trigger this vulnerability. [5] - CVE-2015-7848 (denial of service) When processing a specially crafted private mode packet, an integer overflow can occur leading to out of bounds memory copy operation. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash. [6] - CVE-2015-7850 (denial of service) An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability. [7] - CVE-2015-7851 (directory traversal) A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability. [8] - CVE-2015-7701 (memory leak) Slow memory leak in CRYPTO_ASSOC. - CVE-2015-7702 (denial of service). Incomplete autokey data packet length checks. - CVE-2015-7703 (directory traversal) configuration directives "pidfile" and "driftfile" should only be allowed locally. - CVE-2015-7704 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7705 (denial of service) Clients that receive a KoD should validate the origin timestamp field. - CVE-2015-7691 (denial of service) Incomplete autokey data packet length checks. - CVE-2015-7692 (denial of service Incomplete autokey data packet length checks. Impact ====== A remote attacker is able to crash the NTP-Server, change the system time, overwrite configuration file or can corrupt the memory. References ========== http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities http://blog.talosintel.com/2015/10/ntpd-vulnerabilities.html http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-s... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7691 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7692 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7701 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7702 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7703 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7704 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7705 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7848 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7849 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7850 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7851 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7852 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7853 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7854 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7855 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7871 [1] http://talosintel.com/reports/TALOS-2015-0069/ [2] http://talosintel.com/reports/TALOS-2015-0065/ [3] http://talosintel.com/reports/TALOS-2015-0054/ [4] http://talosintel.com/reports/TALOS-2015-0063/ [5] http://talosintel.com/reports/TALOS-2015-0064/ [6] http://talosintel.com/reports/TALOS-2015-0052/ [7] http://talosintel.com/reports/TALOS-2015-0055/ [8] http://talosintel.com/reports/TALOS-2015-0062/