ntp: multiple issues

2015-10-22T00:00:00
ID ASA-201510-14
Type archlinux
Reporter Arch Linux
Modified 2015-10-22T00:00:00

Description

  • CVE-2015-7871 (authentication bypass) An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off­-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto­-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is credited with discovering this vulnerability. [1]

  • CVE-2015-7855 (denial of service) decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values. This can cause a denial of service.

  • CVE-2015-7854 (memory corruption) A potential buffer overflow vulnerability exists in the password management functionality of ntp. A specially crafted key file could cause a buffer overflow potentially resulting in memory being modified. An attacker could provide a malicious password to trigger this vulnerability. [2]

  • CVE-2015-7849 (memory corruption) An exploitable use-after-free vulnerability exists in the password management functionality of the Network Time Protocol. A specially crafted key file could cause a buffer overflow resulting in memory corruption. An attacker could provide a malicious password file to trigger this vulnerability. [3]

  • CVE-2015-7852 (memory corruption) A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. [4]

  • CVE-2015-7853 (memory corruption) A potential buffer overflow vulnerability exists in the refclock of ntpd. An invalid length provided by a hardware reference clock could cause a buffer overflow potentially resulting in memory being modified. A malicious reflock could provide a negative length to trigger this vulnerability. [5]

  • CVE-2015-7848 (denial of service) When processing a specially crafted private mode packet, an integer overflow can occur leading to out of bounds memory copy operation. The crafted packet needs to have the correct message authentication code and a valid timestamp. When processed by the NTP daemon, it leads to an immediate crash. [6]

  • CVE-2015-7850 (denial of service) An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability. [7]

  • CVE-2015-7851 (directory traversal) A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability. [8]

  • CVE-2015-7701 (memory leak) Slow memory leak in CRYPTO_ASSOC.

  • CVE-2015-7702 (denial of service). Incomplete autokey data packet length checks.

  • CVE-2015-7703 (directory traversal) configuration directives "pidfile" and "driftfile" should only be allowed locally.

  • CVE-2015-7704 (denial of service) Clients that receive a KoD should validate the origin timestamp field.

  • CVE-2015-7705 (denial of service) Clients that receive a KoD should validate the origin timestamp field.

  • CVE-2015-7691 (denial of service) Incomplete autokey data packet length checks.

  • CVE-2015-7692 (denial of service Incomplete autokey data packet length checks.