[arch-security] [ASA-201601-19] ntp: time alteration

[Remi Gacogne]

Arch Linux Security Advisory ASA-201601-19
==========================================

Severity: Medium
Date    : 2016-01-17
CVE-ID  : CVE-2015-5300
Package : ntp
Type    : time alteration
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE

Summary
=======

The package ntp before version 4.2.8.p5-1 is vulnerable to time alteration.

Resolution
==========

Upgrade to 4.2.8.p5-1.

# pacman -Syu "ntp>=4.2.8.p5-1"

The problem has been fixed upstream in version 4.2.8.p5.

Workaround
==========

Removing -g from the ntpd startup options limits the time modification
to 900s per attack.
This can be done by editing the ExecStart line of the
/usr/lib/systemd/system/ntpd.service file to remove the -g option, then
issuing:

# systemctl daemon-reload
# systemctl restart ntpd

Description
===========

If ntpd is always started with the -g option, which is common and
against long-standing recommendation, and if at the moment ntpd is
restarted an attacker can immediately respond to enough requests from
enough sources trusted by the target, which is difficult and not common,
there is a window of opportunity where the attacker can cause ntpd to
set the time to an arbitrary value.
Similarly, if an attacker is able to respond to enough requests from
enough sources trusted by the target, the attacker can cause ntpd to
abort and restart, at which point it can tell the target to set the time
to an arbitrary value if and only if ntpd was re-started against
long-standing recommendation with the -g flag, or if ntpd was not given
the -g flag, the attacker can move the target system's time by at most
900 seconds' time per attack.

Impact
======

As the ntpd default startup options on Arch contain -g, a remote
attacker might be able to alter the system time to an arbitrary value,
bypassing checks based on the time, like for example X.509 certificates
expiration dates.

References
==========

https://access.redhat.com/security/cve/CVE-2015-5300
http://support.ntp.org/bin/view/Main/NtpBug2956
https://www.cs.bu.edu/~goldbe/NTPattack.html

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 801 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20160117/1276a789/attachment.asc>