[arch-security] [ASA-201510-14] ntp: multiple issues

Thu Oct 22 09:43:36 UTC 2015

Arch Linux Security Advisory ASA-201510-14
==========================================

Severity: Critical
Date    : 2015-10-22
CVE-ID  : CVE-2015-7691 CVE-2015-7692 CVE-2015-7701 CVE-2015-7702 CVE-2015-7703
          CVE-2015-7704 CVE-2015-7705 CVE-2015-7848 CVE-2015-7849 CVE-2015-7850
          CVE-2015-7851 CVE-2015-7852 CVE-2015-7853 CVE-2015-7854 CVE-2015-7855
          CVE-2015-7871
Package : ntp
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package ntp before version 4.2.8.p4-1 is vulnerable to multiple issues
including denial of service, memory corruption, directory traversal,
memory leaks and authentication bypass.

Resolution
==========

Upgrade to 4.2.8.p4-1.

# pacman -Syu "ntp>=4.2.8.p4-1"

The problems have been fixed upstream in version 4.2.8.p4.

Workaround
==========

None.

Description
===========

- CVE-2015-7871 (authentication bypass) 
An error handling logic error exists within ntpd that manifests due to improper
error condition handling associated with certain crypto-NAK packets. An
unauthenticated, off-path attacker can force ntpd processes on targeted servers
to peer with time sources of the attacker's choosing by transmitting symmetric
active crypto-NAK packets to ntpd. This attack bypasses the authentication
typically required to establish a peer association and allows an attacker to
make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is
credited with discovering this vulnerability. [1] 

- CVE-2015-7855 (denial of service)
decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values.
This can cause a denial of service.

- CVE-2015-7854 (memory corruption)
A potential buffer overflow vulnerability exists in the password management
functionality of ntp. A specially crafted key file could cause a buffer overflow
potentially resulting in memory being modified. An attacker could provide a
malicious password to trigger this vulnerability. [2]

- CVE-2015-7849 (memory corruption)
An exploitable use-after-free vulnerability exists in the password management
functionality of the Network Time Protocol. A specially crafted key file could
cause a buffer overflow resulting in memory corruption. An attacker could
provide a malicious password file to trigger this vulnerability. [3]

- CVE-2015-7852 (memory corruption)
A potential off by one vulnerability exists in the cookedprint functionality of
ntpq. A specially crafted buffer could cause a buffer overflow potentially
resulting in null byte being written out of bounds. [4]

- CVE-2015-7853 (memory corruption)
A potential buffer overflow vulnerability exists in the refclock of ntpd. An
invalid length provided by a hardware reference clock could cause a buffer
overflow potentially resulting in memory being modified. A malicious reflock
could provide a negative length to trigger this vulnerability. [5]

- CVE-2015-7848 (denial of service)
When processing a specially crafted private mode packet, an integer overflow can
occur leading to out of bounds memory copy operation. The crafted packet needs
to have the correct message authentication code and a valid timestamp. When
processed by the NTP daemon, it leads to an immediate crash. [6]

- CVE-2015-7850 (denial of service)
An exploitable denial of service vulnerability exists in the remote
configuration functionality of the Network Time Protocol. A specially crafted
configuration file could cause an endless loop resulting in a denial of service.
An attacker could provide a the malicious configuration file to trigger this
vulnerability. [7]

- CVE-2015-7851 (directory traversal)
A potential path traversal vulnerability exists in the config file saving of
ntpd on VMS. A specially crafted path could cause a path traversal potentially
resulting in files being overwritten. An attacker could provide a malicious path
to trigger this vulnerability. [8] 

- CVE-2015-7701 (memory leak)
Slow memory leak in CRYPTO_ASSOC.

- CVE-2015-7702 (denial of service).
Incomplete autokey data packet length checks.

- CVE-2015-7703 (directory traversal)
configuration directives "pidfile" and "driftfile" should only be allowed
locally. 

- CVE-2015-7704 (denial of service)
Clients that receive a KoD should validate the origin timestamp field.

- CVE-2015-7705 (denial of service)
Clients that receive a KoD should validate the origin timestamp field.

- CVE-2015-7691 (denial of service)
Incomplete autokey data packet length checks.

- CVE-2015-7692 (denial of service 
Incomplete autokey data packet length checks.

Impact
======

A remote attacker is able to crash the NTP-Server, change the system time,
overwrite configuration file or can corrupt the memory.

References
==========

http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
http://blog.talosintel.com/2015/10/ntpd-vulnerabilities.html
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20151021-ntp
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7691
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7692
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7701
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7702
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7703
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7704
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7705
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7848
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7849
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7850
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7851
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7852
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7853
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7854
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7855
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-7871
[1] http://talosintel.com/reports/TALOS-2015-0069/
[2] http://talosintel.com/reports/TALOS-2015-0065/
[3] http://talosintel.com/reports/TALOS-2015-0054/
[4] http://talosintel.com/reports/TALOS-2015-0063/
[5] http://talosintel.com/reports/TALOS-2015-0064/
[6] http://talosintel.com/reports/TALOS-2015-0052/
[7] http://talosintel.com/reports/TALOS-2015-0055/
[8] http://talosintel.com/reports/TALOS-2015-0062/

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20151022/0173fc41/attachment.asc>