Network Time Protocol libntp Message Digest Disclosure Vulnerability

SUMMARY

An exploitable vulnerability exists in the message authentication functionality of Network Time Protocol libntp. An attacker can send a series of crafted messages to attempt to recover the message digest key.

TESTED VERSIONS

ntp 4.2.8p4 NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92

PRODUCT URLS

http://www.ntp.org http://www.ntpsec.org/

CVSS SCORE

CVSSv2: 4.0 - AV:N/AC:H/Au:N/C:P/I:P/A:N CVSSv3: 4.8 - AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

DETAILS

The MD5authdecrypt() function in libntp/a_md5encrypt.c is used to verify the authenticity of a received packet that uses keyed-hash symmetric authentication, where the hash algorithm used is specified by an argument passed to the function.This functionality is implemented by comparing a received message digest to one computed by using the input packet and the key pointed to by the input packet’s key id field.

The comparison is performed with memcmp() or the byte specific version bcmp() depending on the NTP version being examined. Depending on how these functions are implemented, a timing attack might be possible. Certain memory comparison function implementations return as soon as a mismatch is found between the compared memory to optimize execution time. As a result, valid memory comparisons will take more time as execution proceeds.

If the memory comparison function compares a small number of bytes at a time, then an attacker could brute-force the message digest by guessing values and determining when the comparison function runs for a longer amount of time. bcmp() is especially susceptible to this type of attack because it is a byte-comparison function.

Instead, it is recommended that a constant time memory comparison function be used. Specifically, the CRYPTO_memcmp() function that is provided by openssl is the recommended replacement.

For more information, please see: https://wiki.openssl.org/index.php/EVP_Signing_and_Verifying#Verifying_2 http://rdist.root.org/2010/08/05/optimized-memcmp-leaks-useful-timing-differences/

TIMELINE

2016-02-11 (approx) - CERT reports to NTP
2016-04-26 - Public disclosure