Network Time Protocol Trusted Keys Memory Corruption Vulnerability

2015-10-21T00:00:00
ID TALOS-2015-0054
Type talos
Reporter Talos Intelligence
Modified 2015-10-21T00:00:00

Description

Talos Vulnerability Report

TALOS-2015-0054

Network Time Protocol Trusted Keys Memory Corruption Vulnerability

October 21, 2015
CVE Number

CVE-2015-7849

Description

An exploitable use-after-free vulnerability exists in the password management functionality of the Network Time Protocol. A specially crafted key file could cause a buffer overflow resulting in memory corruption. An attacker could provide a malicious password file to trigger this vulnerability.

Tested Versions

ntp 4.2.8p2

Product URLs

<http://www.ntp.org>

Details

The function authdelkeys() will free all the keys that are used for user authentication. In the case of normal keys, they will also be removed from the list of keys. However in the case of trusted keys, the memory holding the keys will be freed but the pointer to that memory location will not be set to NULL.

This is the code at line 598 in authkeys.c:

    if (KEY_TRUSTED & sk-&gt;flags) {
        if (sk-&gt;secret != NULL) {
            memset(sk-&gt;secret, '\0', sk-&gt;secretsize);
            free(sk-&gt;secret);
        }
        sk-&gt;secretsize = 0;
        sk-&gt;lifetime = 0;
    } else {

Since the key is still in the linked list it will simply be copied to at line 541 in authkeys.c:

    for (sk = *bucket; sk != NULL; sk = sk-&gt;hlink) {
        if (keyno == sk-&gt;keyid) {
            sk-&gt;type = (u_short)keytype;
            secretsize = len;
            sk-&gt;secretsize = (u_short)secretsize;
#ifndef DISABLE_BUG1243_FIX
            memcpy(sk-&gt;secret, key, secretsize);

Reuse of a previous buffer can lead to inconsistencies in authentication tokens or memory corruption.

Credit

Yves Younan of Cisco Talos


Vulnerability Reports Next Report

TALOS-2015-0055

Previous Report

TALOS-2015-0052