Arch Linux Security Advisory ASA-201803-11 ========================================== Severity: High Date : 2018-03-16 CVE-ID : CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 Package : ntp Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-647 Summary ======= The package ntp before version 4.2.8.p11-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and denial of service. Resolution ========== Upgrade to 4.2.8.p11-1. # pacman -Syu "ntp>=4.2.8.p11-1" The problems have been fixed upstream in version 4.2.8.p11. Workaround ========== None. Description =========== - CVE-2016-1549 (content spoofing) A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock. - CVE-2018-7170 (content spoofing) ntpd can be vulnerable to Sybil attacks. If a system is set up to use a trustedkey and if one is not using the feature introduced in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to specify which IPs can serve time, a malicious authenticated peer -- i.e. one where the attacker knows the private symmetric key -- can create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock. - CVE-2018-7182 (denial of service) ctl_getitem() is used by ntpd to process incoming mode 6 packets. A malicious mode 6 packet can be sent to an ntpd instance, and if the ntpd instance is from 4.2.8p6 thru 4.2.8p10, that will cause ctl_getitem() to read past the end of its buffer. - CVE-2018-7183 (arbitrary code execution) ntpq is a monitoring and control program for ntpd. decodearr() is an internal function of ntpq that is used to -- wait for it -- decode an array in a response string when formatted data is being displayed. This is a problem in affected versions of ntpq if a maliciously-altered ntpd returns an array result that will trip this bug, or if a bad actor is able to read an ntpq request on its way to a remote ntpd server and forge and send a response before the remote ntpd sends its response. It's potentially possible that the malicious data could become injectable/executable code. - CVE-2018-7184 (denial of service) The fix for NtpBug2952 was incomplete, and while it fixed one problem it created another. Specifically, it drops bad packets before updating the "received" timestamp. This means a third-party can inject a packet with a zero-origin timestamp, meaning the sender wants to reset the association, and the transmit timestamp in this bogus packet will be saved as the most recent "received" timestamp. The real remote peer does not know this value and this will disrupt the association until the association resets. - CVE-2018-7185 (denial of service) The NTP Protocol allows for both non-authenticated and authenticated associations, in client/server, symmetric (peer), and several broadcast modes. In addition to the basic NTP operational modes, symmetric mode and broadcast servers can support an interleaved mode of operation. In ntp-4.2.8p4 a bug was inadvertently introduced into the protocol engine that allows a non-authenticated zero-origin (reset) packet to reset an authenticated interleaved peer association. If an attacker can send a packet with a zero-origin timestamp and the source IP address of the "other side" of an interleaved association, the 'victim' ntpd will reset its association. The attacker must continue sending these packets in order to maintain the disruption of the association. In ntp-4.0.0 thru ntp-4.2.8p6, interleave mode could be entered dynamically. As of ntp-4.2.8p7, interleaved mode must be explicitly configured/enabled. Impact ====== A remote, non-authenticated peer can cause a denial of service, preventing the vulnerable host from getting a correct time. In addition to that, a remote, authenticated peer can spoof the correct time, causing the vulnerable host to update its clock with an invalid time. A malicious NTPd server, or an attacker in position of man-in-the- middle might be able to execute arbitrary code on the affected host by forging a response to an ntpq request. References ========== http://support.ntp.org/bin/view/Main/NtpBug3012 http://support.ntp.org/bin/view/Main/NtpBug3415 http://support.ntp.org/bin/view/Main/NtpBug3412 http://support.ntp.org/bin/view/Main/NtpBug3414 http://support.ntp.org/bin/view/Main/NtpBug3453 http://support.ntp.org/bin/view/Main/NtpBug3454 https://security.archlinux.org/CVE-2016-1549 https://security.archlinux.org/CVE-2018-7170 https://security.archlinux.org/CVE-2018-7182 https://security.archlinux.org/CVE-2018-7183 https://security.archlinux.org/CVE-2018-7184 https://security.archlinux.org/CVE-2018-7185