The remote NTP server is affected by a denial of service vulnerability due to improper validation of mrulist queries. An unauthenticated, remote attacker can exploit this, via a specially crafted NTP mrulist query packet, to terminate the ntpd process.
Note that the NTP server is reportedly affected by additional vulnerabilities as well; however, Nessus has not tested for these.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(95389);
script_version("1.14");
script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/12");
script_cve_id("CVE-2016-7434");
script_bugtraq_id(94448);
script_xref(name:"CERT", value:"633847");
script_xref(name:"EDB-ID", value:"40806");
script_name(english:"Network Time Protocol Daemon (ntpd) read_mru_list() Remote DoS");
script_summary(english:"Checks response from a mrulist query.");
script_set_attribute(attribute:"synopsis", value:
"The remote NTP server is affected by a denial of service
vulnerability.");
script_set_attribute(attribute:"description", value:
"The remote NTP server is affected by a denial of service vulnerability
due to improper validation of mrulist queries. An unauthenticated,
remote attacker can exploit this, via a specially crafted NTP mrulist
query packet, to terminate the ntpd process.
Note that the NTP server is reportedly affected by additional
vulnerabilities as well; however, Nessus has not tested for these.");
script_set_attribute(attribute:"see_also", value:"http://support.ntp.org/bin/view/Main/NtpBug3082");
script_set_attribute(attribute:"see_also", value:"https://www.nwtime.org/ntp428p9_release/");
script_set_attribute(attribute:"solution", value:
"Upgrade to NTP version 4.2.8p9 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7434");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/11/21");
script_set_attribute(attribute:"patch_publication_date", value:"2016/11/21");
script_set_attribute(attribute:"plugin_publication_date", value:"2016/11/29");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe", value:"cpe:/a:ntp:ntp");
script_end_attributes();
script_category(ACT_ATTACK);
script_copyright(english:"This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"Misc.");
script_dependencies("ntp_open.nasl");
script_require_keys("NTP/Running");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("byte_func.inc");
# Make sure NTP server is running
get_kb_item_or_exit('NTP/Running');
# Get ntp server port
port = get_service(svc:"ntp", ipproto:"udp", default:123, exit_on_fail:TRUE);
# Connect to the ntp server
s = open_sock_udp(port);
if (!s) audit(AUDIT_SOCK_FAIL, port);
# CTL_OP_REQ_NONCE
req =
'\x1e' +
'\x0c' +
'\x00\x01' +
'\x00\x00' +
'\x00\x00' +
'\x00\x00' +
'\x00\x00';
send(socket: s, data: req);
res = recv(socket:s, length:1024);
if("nonce" >!< res)
{
exit(0, 'Failed to get nonce for a mrulist query. Possible reasons : \n' +
'- Remote NTP server may have disabled mrulist query.\n' +
'- Remote NTP server does not support mrulist query.');
}
i = stridx(res, "nonce");
nonce = substr(res, i);
nonce = str_replace(string: nonce, find:'\x0d', replace:'');
nonce = str_replace(string: nonce, find:'\x0a', replace:'');
# CTL_OP_READ_MRU
#
# vulnerable and patched ntpd handle the malformed 'frags'
# parameter differently
data = nonce + ",frags=aaa,limit=1";
req =
'\x1e' +
'\x0a' +
'\x00\x02' +
'\x00\x00' +
'\x00\x00' +
'\x00\x00' +
mkword(strlen(data), order: BYTE_ORDER_BIG_ENDIAN);
req += data;
if (strlen(req) % 4)
req += crap(data:'\x00', length: 4 - strlen(req) % 4);
send(socket: s, data: req);
res = recv(socket:s, length:1024);
close(s);
# Vulnerable ntpd ignores the malformed 'frags'
# parameter, and continues processing the CTL_OP_READ_MRU command.
if(res)
{
security_report_v4(
port : port,
proto : "udp",
severity : SECURITY_WARNING
);
}
# Patched ntpd stops processing the CTL_OP_READ_MRU command upon
# encountering a malformed 'frags' parameter.
else
{
audit(AUDIT_HOST_NOT, 'affected');
}