Bug 16999

Summary:	ntp new security issues fixed upstream in ntp-4.2.8p4
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	critical
Priority:	Normal	CC:	davidwhodgins, sysadmin-bugs, westel
Version:	5	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/661765/
Whiteboard:	MGA5-32-OK MGA5-64-OK advisory
Source RPM:	ntp-4.2.6p5-24.1.mga5.src.rpm	CVE:
Status comment:

Description David Walser 2015-10-22 20:40:54 CEST

Upstream has announced several new security issues on October 21:
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner

Apparently all of the issues don't affect 4.2.6, as Fedora has only patched:

- check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
- allow only one step larger than panic threshold with -g (CVE-2015-5300)
- fix memory leak with autokey (CVE-2015-7701)
- don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
  CVE-2015-7702)
- don't crash in ntpq with crafted packet (CVE-2015-7852)
- don't mobilize passive association with crypto NAK (CVE-2015-7871)

They also fixed the dependencies of ntpdate.service, which should prevent it trying to start too early and failing.

More info on the security issues:
https://www.cs.bu.edu/~goldbe/NTPattack.html

Patched packages uploaded for Mageia 5 and Cauldron.

I'll update the advisory with a Fedora advisory link once it's available.  It is currently assigned to QA:
https://bodhi.fedoraproject.org/updates/FEDORA-2015-de44abca87

Advisory:
========================

Updated ntp packages fix security vulnerabilities:

It was found that ntpd did not correctly implement the threshold limitation
for the '-g' option, which is used to set the time without any restrictions.
A man-in-the-middle attacker able to intercept NTP traffic between a
connecting client and an NTP server could use this flaw to force that client
to make multiple steps larger than the panic threshold, effectively changing
the time to an arbitrary value at any time (CVE-2015-5300).

Slow memory leak in CRYPTO_ASSOC with autokey (CVE-2015-7701).

Incomplete autokey data packet length checks could result in crash caused by
a crafted packet (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702).

Clients that receive a KoD should validate the origin timestamp field
(CVE-2015-7704).

ntpq atoascii() Memory Corruption Vulnerability could result in ntpd crash
caused by a crafted packet (CVE-2015-7852).

Symmetric association authentication bypass via crypto-NAK (CVE-2015-7871).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7692
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7852
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7871
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
========================

Updated packages in core/updates_testing:
========================
ntp-4.2.6p5-24.2.mga5
ntp-client-4.2.6p5-24.2.mga5
ntp-doc-4.2.6p5-24.2.mga5

from ntp-4.2.6p5-24.2.mga5.src.rpm

Reproducible: 

Steps to Reproduce:

David Walser 2015-10-22 20:41:07 CEST

Version: Cauldron => 5

Comment 1 David Walser 2015-10-23 17:22:48 CEST

Working fine on our main server here at work, Mageia 5 i586.

Whiteboard: (none) => MGA5-32-OK

Dave Hodgins 2015-10-25 22:19:42 CET

CC: (none) => davidwhodgins, sysadmin-bugs
Whiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK advisory
Keywords: (none) => validated_update

Comment 2 Mageia Robot 2015-10-25 22:51:20 CET

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0413.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 3 David Walser 2015-10-26 20:59:34 CET

LWN reference for CVE-2015-5300:
http://lwn.net/Vulnerabilities/662065/

Comment 4 Liam Hellen 2023-11-01 09:37:21 CET Comment hidden (spam)

Your article is very good and attractive. It's great to sip your morning coffee and read a high-quality article like this https://wordleplay.io . Thanks a lot

CC: (none) => liamhellen55

Comment 5 guru blori 2024-01-20 14:39:51 CET Comment hidden (spam)

Find a wide determination of first-class bike suits for your riding closet. motorcycle racing suit


https://milogears.com/en-us/products/copy-of-gear-up-for-the-ride-with-our-wide-selection-of-replica-motorcycle-suits-perfect-for-racing-riding-one-and-two-piece-high-quality-leather-suit

CC: (none) => alinomi07

Dave Hodgins 2024-01-20 16:14:27 CET

CC: alinomi07, liamhellen55 => (none)

Comment 6 Thomas Tate 2024-05-11 09:45:14 CEST Comment hidden (spam)

Your sharing is very useful, https://papasgamesfree.github.io will continue to come back and learn more.

CC: (none) => tiveg92301

Ben McMonagle 2024-05-11 10:17:28 CEST

CC: tiveg92301 => westel

Comment 7 Fes Cop 2024-07-15 09:55:12 CEST Comment hidden (spam)

Anyone who can juggle multiple tasks with ease will fit right in with the Papa's franchise. Your role in the [url=https://papasgames.pro]papa's games[/url] series is to assist with the management of a restaurant. Stay on top of things, though; orders can add up rapidly. Receive orders, cook the dish, and ensure client satisfaction to earn generous gratuities.

CC: (none) => vokikox565

Comment 8 Fes Cop 2024-07-15 09:55:48 CEST Comment hidden (spam)

Anyone who can juggle multiple tasks with ease will fit right in with the Papa's franchise. Your role in the https://papasgames.pro/

Ben McMonagle 2024-07-15 10:04:06 CEST

CC: vokikox565 => (none)