3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
160 lines
5.3 KiB
Text
160 lines
5.3 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:31 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: ntpd contains potential remote compromise
|
|
|
|
Category: core/ports
|
|
Module: ntpd
|
|
Announced: 2001-04-06
|
|
Credits: Przemyslaw Frasunek <venglin@FREEBSD.LUBLIN.PL>
|
|
Affects: FreeBSD 3.x (all releases), FreeBSD 4.x (all releases),
|
|
FreeBSD 3.5-STABLE and 4.2-STABLE prior to the
|
|
correction date.
|
|
Ports collection prior to the correction date.
|
|
Corrected: 2001-04-06 (FreeBSD 4.2-STABLE, 3.5-STABLE, and ports)
|
|
Vendor status: Vendor notified.
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
The ntpd daemon is an implementation of the Network Time Protocol
|
|
(NTP) used to synchronize the time of a computer system to a
|
|
reference time source. Older versions of ntpd, such as those in
|
|
FreeBSD 3.x, were named xntpd.
|
|
|
|
II. Problem Description
|
|
|
|
An overflowable buffer exists in the ntpd daemon related to the
|
|
building of a response for a query with a large readvar argument.
|
|
Due to insufficient bounds checking, a remote attacker may be able
|
|
to cause arbitrary code to be executed as the user running the
|
|
ntpd daemon, usually root.
|
|
|
|
All versions of FreeBSD prior to the correction date, including
|
|
FreeBSD 3.5.1 and 4.2, and versions of the ntpd port prior to
|
|
ntp-4.0.99k_2 contain this problem. The base system and ports
|
|
collections that will ship with FreeBSD 4.3 do not contain this
|
|
problem since it was corrected before the release.
|
|
|
|
III. Impact
|
|
|
|
Malicious remote users may be able to execute arbitrary code on an
|
|
ntpd server as the user running the ntpd daemon, usually root.
|
|
|
|
The ntpd daemon is not enabled by default. If you have not enabled
|
|
ntpd, your system is not vulnerable.
|
|
|
|
IV. Workaround
|
|
|
|
Disable the ntpd daemon using the following command:
|
|
|
|
# kill -KILL `cat /var/run/ntpd.pid`
|
|
|
|
Additionally, the ntpd daemon should be disabled in the system's
|
|
startup configuration file /etc/rc.conf, normally accomplished by
|
|
changing "xntpd_enable=YES" to "xntpd_enable=NO".
|
|
|
|
Since NTP is a stateless UDP-based protocol, source addresses can be
|
|
spoofed rendering firewalling ineffective for stopping this
|
|
vulnerability.
|
|
|
|
V. Solution
|
|
|
|
[Base system]
|
|
|
|
One of the following:
|
|
|
|
1) Upgrade to FreeBSD 4.2-STABLE or 3.5.1-STABLE after the correction
|
|
date.
|
|
|
|
2) Download the patch and detached PGP signature from the following
|
|
location:
|
|
|
|
The following patch applies to FreeBSD 4.x.
|
|
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:31/ntpd-4.x.patch
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:31/ntpd-4.x.patch.asc
|
|
|
|
The folllowing patch applies to FreeBSD 3.x.
|
|
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:31/ntpd-3.x.patch
|
|
# fetch ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:31/ntpd-3.x.patch.asc
|
|
|
|
Verify the detached signature using your PGP utility.
|
|
|
|
Issue the following commands as root:
|
|
|
|
[FreeBSD 4.x]
|
|
|
|
# cd /usr/src
|
|
# patch -p < /path/to/patch
|
|
# cd /usr/src/usr.sbin/ntp
|
|
# make all install
|
|
|
|
[FreeBSD 3.x]
|
|
|
|
# cd /usr/src
|
|
# patch -p < /path/to/patch
|
|
# cd /usr/src/usr.sbin/xntpd
|
|
# make all install
|
|
|
|
Finally, if ntpd is already running then kill and restart the ntpd
|
|
daemon: perform the following command as root:
|
|
|
|
# kill -KILL `cat /var/run/ntpd.pid` && /usr/sbin/ntpd
|
|
|
|
[Ports collection]
|
|
|
|
Use one of the following options to upgrade the ntpd software, then
|
|
kill and restart the ntpd daemon if it is already running.
|
|
|
|
To kill and restart the ntpd daemon, perform the following command as
|
|
root:
|
|
|
|
# kill -KILL `cat /var/run/ntpd.pid` && /usr/local/sbin/ntpd
|
|
|
|
1) Upgrade your entire ports collection and rebuild the ntpd port.
|
|
|
|
2) Deinstall the old package and install a new package dated after the
|
|
correction date, obtained from:
|
|
|
|
[i386]
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/net/ntp-4.0.99k_2.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/net/ntp-4.0.99k_2.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/net/ntp-4.0.99k_2.tgz
|
|
|
|
NOTE: It may be several days before updated packages are available.
|
|
|
|
[alpha]
|
|
Packages are not automatically generated for the alpha architecture at
|
|
this time due to lack of build resources.
|
|
|
|
3) download a new port skeleton for the ntpd port from:
|
|
|
|
http://www.freebsd.org/ports/
|
|
|
|
and use it to rebuild the port.
|
|
|
|
4) Use the portcheckout utility to automate option (3) above. The
|
|
portcheckout port is available in /usr/ports/devel/portcheckout or the
|
|
package can be obtained from:
|
|
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-3-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-4-stable/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/devel/portcheckout-2.0.tgz
|
|
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/alpha/packages-5-current/devel/portcheckout-2.0.tgz
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: FreeBSD: The Power To Serve
|
|
|
|
iQCVAwUBOs5Oi1UuHi5z0oilAQGb+QP+MqTyEGJBziGnw2gHwAnK3lAaMFyKurBc
|
|
cgpm61uWpOBsTnJGJ9t5uI3IGPjxsjjmyZR2ONYMIUCRC2b6MA21oEsenD3F8Jeu
|
|
UphzKdv9IswnSkZFRI5v0PoFtUOKihDU1SLfp2DKjJel8HralhYuDiCOQ/pIpGCj
|
|
emIKnwcGVu4=
|
|
=FTKv
|
|
-----END PGP SIGNATURE-----
|