225 lines
8.4 KiB
Text
225 lines
8.4 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
Hash: SHA512
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-16:09.ntp Security Advisory
|
|
The FreeBSD Project
|
|
|
|
Topic: Multiple vulnerabilities of ntp
|
|
|
|
Category: contrib
|
|
Module: ntp
|
|
Announced: 2016-01-27
|
|
Credits: Cisco ASIG / Network Time Foundation
|
|
Affects: All supported versions of FreeBSD.
|
|
Corrected: 2016-01-22 15:55:21 UTC (stable/10, 10.2-STABLE)
|
|
2016-01-27 07:41:31 UTC (releng/10.2, 10.2-RELEASE-p11)
|
|
2016-01-27 07:41:31 UTC (releng/10.1, 10.1-RELEASE-p28)
|
|
2016-01-22 15:56:35 UTC (stable/9, 9.3-STABLE)
|
|
2016-01-27 07:42:11 UTC (releng/9.3, 9.3-RELEASE-p35)
|
|
CVE Name: CVE-2015-7973, CVE-2015-7974, CVE-2015-7975, CVE-2015-7976,
|
|
CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8138,
|
|
CVE-2015-8139, CVE-2015-8140, CVE-2015-8158
|
|
|
|
For general information regarding FreeBSD Security Advisories,
|
|
including descriptions of the fields above, security branches, and the
|
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
|
|
|
I. Background
|
|
|
|
The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP)
|
|
used to synchronize the time of a computer system to a reference time
|
|
source.
|
|
|
|
II. Problem Description
|
|
|
|
Multiple vulnerabilities have been discovered in ntp 4.2.8p5:
|
|
|
|
Potential Infinite Loop in ntpq. [CVE-2015-8158]
|
|
|
|
A logic error would allow packets with an origin timestamp of zero
|
|
to bypass this check whenever there is not an outstanding request
|
|
to the server. [CVE-2015-8138]
|
|
|
|
Off-path Denial of Service (DoS) attack on authenticated broadcast mode.
|
|
[CVE-2015-7979]
|
|
|
|
Stack exhaustion in recursive traversal of restriction list. [CVE-2015-7978]
|
|
|
|
reslist NULL pointer dereference. [CVE-2015-7977]
|
|
|
|
ntpq saveconfig command allows dangerous characters in filenames.
|
|
[CVE-2015-7976]
|
|
|
|
nextvar() missing length check. [CVE-2015-7975]
|
|
|
|
Skeleton Key: Missing key check allows impersonation between authenticated
|
|
peers. [CVE-2015-7974]
|
|
|
|
Deja Vu: Replay attack on authenticated broadcast mode. [CVE-2015-7973]
|
|
|
|
ntpq vulnerable to replay attacks. [CVE-2015-8140]
|
|
|
|
Origin Leak: ntpq and ntpdc, disclose origin. [CVE-2015-8139]
|
|
|
|
III. Impact
|
|
|
|
A malicious NTP server, or an attacker who can conduct MITM attack by
|
|
intercepting NTP query traffic, may be able to cause a ntpq client to
|
|
infinitely loop. [CVE-2015-8158]
|
|
|
|
A malicious NTP server, or an attacker who can conduct MITM attack by
|
|
intercepting NTP query traffic, may be able to prevent a ntpd(8) daemon
|
|
to distinguish between legitimate peer responses from forgeries. This
|
|
can partially be mitigated by configuring multiple time sources.
|
|
[CVE-2015-8138]
|
|
|
|
An off-path attacker who can send broadcast packets with bad
|
|
authentication (wrong key, mismatched key, incorrect MAC, etc) to
|
|
broadcast clients can cause these clients to tear down associations.
|
|
[CVE-2015-7979]
|
|
|
|
An attacker who can send unauthenticated 'reslist' command to a NTP
|
|
server may cause it to crash, resulting in a denial of service
|
|
condition due to stack exhaustion [CVE-2015-7978] or a NULL pointer
|
|
dereference [CVE-2015-7977].
|
|
|
|
An attacker who can send 'modify' requests to a NTP server may be
|
|
able to create file that contain dangerous characters in their name,
|
|
which could cause dangerous behavior in a later shell invocation.
|
|
[CVE-2015-7976]
|
|
|
|
A remote attacker may be able to crash a ntpq client. [CVE-2015-7975]
|
|
|
|
A malicious server which holds a trusted key may be able to
|
|
impersonate other trusted servers in an authenticated configuration.
|
|
[CVE-2015-7974]
|
|
|
|
A man-in-the-middle attacker or a malicious participant that has the
|
|
same trusted keys as the victim can replay time packets if the NTP
|
|
network is configured for broadcast operations. [CVE-2015-7973]
|
|
|
|
The ntpq protocol is vulnerable to replay attacks which may be used
|
|
to e.g. re-establish an association to malicious server. [CVE-2015-8140]
|
|
|
|
An attacker who can intercept NTP traffic can easily forge live server
|
|
responses. [CVE-2015-8139]
|
|
|
|
IV. Workaround
|
|
|
|
No workaround is available, but systems not running ntpd(8) are not
|
|
affected. Network administrators are advised to implement BCP-38,
|
|
which helps to reduce risk associated with the attacks.
|
|
|
|
V. Solution
|
|
|
|
Perform one of the following:
|
|
|
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
|
release / security branch (releng) dated after the correction date.
|
|
|
|
The ntpd service has to be restarted after the update. A reboot is
|
|
recommended but not required.
|
|
|
|
2) To update your vulnerable system via a binary patch:
|
|
|
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
|
platforms can be updated via the freebsd-update(8) utility:
|
|
|
|
# freebsd-update fetch
|
|
# freebsd-update install
|
|
|
|
The ntpd service has to be restarted after the update. A reboot is
|
|
recommended but not required.
|
|
|
|
3) To update your vulnerable system via a source code patch:
|
|
|
|
The following patches have been verified to apply to the applicable
|
|
FreeBSD release branches.
|
|
|
|
a) Download the relevant patch from the location below, and verify the
|
|
detached PGP signature using your PGP utility.
|
|
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:09/ntp.patch
|
|
# fetch https://security.FreeBSD.org/patches/SA-16:09/ntp.patch.asc
|
|
# gpg --verify ntp.patch.asc
|
|
|
|
b) Apply the patch. Execute the following commands as root:
|
|
|
|
# cd /usr/src
|
|
# patch < /path/to/patch
|
|
|
|
c) Recompile the operating system using buildworld and installworld as
|
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
|
|
|
Restart the applicable daemons, or reboot the system.
|
|
|
|
VI. Correction details
|
|
|
|
The following list contains the correction revision numbers for each
|
|
affected branch.
|
|
|
|
Branch/path Revision
|
|
- -------------------------------------------------------------------------
|
|
stable/9/ r294570
|
|
releng/9.3/ r294905
|
|
stable/10/ r294569
|
|
releng/10.1/ r294904
|
|
releng/10.2/ r294904
|
|
- -------------------------------------------------------------------------
|
|
|
|
To see which files were modified by a particular revision, run the
|
|
following command, replacing NNNNNN with the revision number, on a
|
|
machine with Subversion installed:
|
|
|
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
|
|
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
|
|
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
|
|
|
VII. References
|
|
|
|
<URL:http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7973>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7974>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7975>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7976>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7977>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7978>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7979>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8138>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8139>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8140>
|
|
|
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8158>
|
|
|
|
The latest revision of this advisory is available at
|
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc>
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v2.1.8 (FreeBSD)
|
|
|
|
iQIcBAEBCgAGBQJWqJZaAAoJEO1n7NZdz2rnHWEQANXpxGqlV5gr1f+bi8LcQW5c
|
|
+FLoHTppBf+t8kB0lFpEdbn/ypO2lkHXGqMyCr52WVeXEW8Pg0Jpac0HjOtkBkPB
|
|
4RzOZ85B7hGUkPKmKDugG3sS1aFC9XNbvp2XHV0vIcaTVuv8Hm0eeAAFelf3r2LY
|
|
JTy5s1+/aB7ZyLrlAPLP2vc+XRcBlHIE7O5CLGMFhuz4KApReT1YPeomXI7+D4ZR
|
|
Xgx1ho1XNiWPwr4rEOwdEhrCy4ICmPh4763ITSRBBigRNMfYX+YZCtE6lEr8Z1Nr
|
|
ciSBNHyiG2uBRYvNttEHARyjU/8eiV01PqQxn+uJmfTA9/UKtT6rY+XIp6sNGDax
|
|
oDB4flqRrnh5ZNkXVx4TBfjgO4TfnFZkU5U1NOsm9/IypXAjxF7aKDX+Ks/UAL2v
|
|
6NhvhGOMEt41nbB7+GubIubCiIxce6ImxkMB4lWlOTZOn8dn6sO5REg3Wr5A3pxd
|
|
yY98L7yDakeVBAsVqea5aBhC2SYwyarReH7OgTPaKgvlbAis7Rbr2gDOgNuOKKWp
|
|
y8Dtn03GL77+ESLkvLRETMhIbiaoVHze0otAx2jlr02kkpTw769BaLclO7CCcOvh
|
|
5OC/eQt2MKQ48FItH/3W6ptNTgynQWX7rdmSvxtZNFqU+J7xaktcdK+KrMQCjTyE
|
|
GlOGafju5SVfUvYxFvAl
|
|
=lb7l
|
|
-----END PGP SIGNATURE-----
|