Home / mailings FreeBSD Security Advisory FreeBSD-SA-16:09.ntp
Posted on 27 January 2016
FreeBSD security notificat-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-16:09.ntp Security Advisory
The FreeBSD Project
Topic: Multiple vulnerabilities of ntp
Category: contrib
Module: ntp
Announced: 2016-01-27
Credits: Cisco ASIG / Network Time Foundation
Affects: All supported versions of FreeBSD.
Corrected: 2016-01-22 15:55:21 UTC (stable/10, 10.2-STABLE)
2016-01-27 07:41:31 UTC (releng/10.2, 10.2-RELEASE-p11)
2016-01-27 07:41:31 UTC (releng/10.1, 10.1-RELEASE-p28)
2016-01-22 15:56:35 UTC (stable/9, 9.3-STABLE)
2016-01-27 07:42:11 UTC (releng/9.3, 9.3-RELEASE-p35)
CVE Name: CVE-2015-7973, CVE-2015-7974, CVE-2015-7975, CVE-2015-7976,
CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8138,
CVE-2015-8139, CVE-2015-8140, CVE-2015-8158
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP)
used to synchronize the time of a computer system to a reference time
source.
II. Problem Description
Multiple vulnerabilities have been discovered in ntp 4.2.8p5:
Potential Infinite Loop in ntpq. [CVE-2015-8158]
A logic error would allow packets with an origin timestamp of zero
to bypass this check whenever there is not an outstanding request
to the server. [CVE-2015-8138]
Off-path Denial of Service (DoS) attack on authenticated broadcast mode.
[CVE-2015-7979]
Stack exhaustion in recursive traversal of restriction list. [CVE-2015-7978]
reslist NULL pointer dereference. [CVE-2015-7977]
ntpq saveconfig command allows dangerous characters in filenames.
[CVE-2015-7976]
nextvar() missing length check. [CVE-2015-7975]
Skeleton Key: Missing key check allows impersonation between authenticated
peers. [CVE-2015-7974]
Deja Vu: Replay attack on authenticated broadcast mode. [CVE-2015-7973]
ntpq vulnerable to replay attacks. [CVE-2015-8140]
Origin Leak: ntpq and ntpdc, disclose origin. [CVE-2015-8139]
III. Impact
A malicious NTP server, or an attacker who can conduct MITM attack by
intercepting NTP query traffic, may be able to cause a ntpq client to
infinitely loop. [CVE-2015-8158]
A malicious NTP server, or an attacker who can conduct MITM attack by
intercepting NTP query traffic, may be able to prevent a ntpd(8) daemon
to distinguish between legitimate peer responses from forgeries. This
can partially be mitigated by configuring multiple time sources.
[CVE-2015-8138]
An off-path attacker who can send broadcast packets with bad
authentication (wrong key, mismatched key, incorrect MAC, etc) to
broadcast clients can cause these clients to tear down associations.
[CVE-2015-7979]
An attacker who can send unauthenticated 'reslist' command to a NTP
server may cause it to crash, resulting in a denial of service
condition due to stack exhaustion [CVE-2015-7978] or a NULL pointer
dereference [CVE-2015-7977].
An attacker who can send 'modify' requests to a NTP server may be
able to create file that contain dangerous characters in their name,
which could cause dangerous behavior in a later shell invocation.
[CVE-2015-7976]
A remote attacker may be able to crash a ntpq client. [CVE-2015-7975]
A malicious server which holds a trusted key may be able to
impersonate other trusted servers in an authenticated configuration.
[CVE-2015-7974]
A man-in-the-middle attacker or a malicious participant that has the
same trusted keys as the victim can replay time packets if the NTP
network is configured for broadcast operations. [CVE-2015-7973]
The ntpq protocol is vulnerable to replay attacks which may be used
to e.g. re-establish an association to malicious server. [CVE-2015-8140]
An attacker who can intercept NTP traffic can easily forge live server
responses. [CVE-2015-8139]
IV. Workaround
No workaround is available, but systems not running ntpd(8) are not
affected. Network administrators are advised to implement BCP-38,
which helps to reduce risk associated with the attacks.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The ntpd service has to be restarted after the update. A reboot is
recommended but not required.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
The ntpd service has to be restarted after the update. A reboot is
recommended but not required.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
# fetch https://security.FreeBSD.org/patches/SA-16:09/ntp.patch
# fetch https://security.FreeBSD.org/patches/SA-16:09/ntp.patch.asc
# gpg --verify ntp.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the applicable daemons, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- -------------------------------------------------------------------------
stable/9/ r294570
releng/9.3/ r294905
stable/10/ r294569
releng/10.1/ r294904
releng/10.2/ r294904
- -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7973>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7974>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7975>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7976>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7977>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7978>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-7979>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-8138>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-8139>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-8140>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2015-8158>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc>
