Bug 16999 - ntp new security issues fixed upstream in ntp-4.2.8p4
Summary: ntp new security issues fixed upstream in ntp-4.2.8p4
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: i586 Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/661765/
Whiteboard: MGA5-32-OK MGA5-64-OK advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-10-22 20:40 CEST by David Walser
Modified: 2024-07-15 10:04 CEST (History)
3 users (show)

See Also:
Source RPM: ntp-4.2.6p5-24.1.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2015-10-22 20:40:54 CEST
Upstream has announced several new security issues on October 21:
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner

Apparently all of the issues don't affect 4.2.6, as Fedora has only patched:

- check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
- allow only one step larger than panic threshold with -g (CVE-2015-5300)
- fix memory leak with autokey (CVE-2015-7701)
- don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,
  CVE-2015-7702)
- don't crash in ntpq with crafted packet (CVE-2015-7852)
- don't mobilize passive association with crypto NAK (CVE-2015-7871)

They also fixed the dependencies of ntpdate.service, which should prevent it trying to start too early and failing.

More info on the security issues:
https://www.cs.bu.edu/~goldbe/NTPattack.html

Patched packages uploaded for Mageia 5 and Cauldron.

I'll update the advisory with a Fedora advisory link once it's available.  It is currently assigned to QA:
https://bodhi.fedoraproject.org/updates/FEDORA-2015-de44abca87

Advisory:
========================

Updated ntp packages fix security vulnerabilities:

It was found that ntpd did not correctly implement the threshold limitation
for the '-g' option, which is used to set the time without any restrictions.
A man-in-the-middle attacker able to intercept NTP traffic between a
connecting client and an NTP server could use this flaw to force that client
to make multiple steps larger than the panic threshold, effectively changing
the time to an arbitrary value at any time (CVE-2015-5300).

Slow memory leak in CRYPTO_ASSOC with autokey (CVE-2015-7701).

Incomplete autokey data packet length checks could result in crash caused by
a crafted packet (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702).

Clients that receive a KoD should validate the origin timestamp field
(CVE-2015-7704).

ntpq atoascii() Memory Corruption Vulnerability could result in ntpd crash
caused by a crafted packet (CVE-2015-7852).

Symmetric association authentication bypass via crypto-NAK (CVE-2015-7871).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5300
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7691
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7692
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7701
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7852
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7871
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
========================

Updated packages in core/updates_testing:
========================
ntp-4.2.6p5-24.2.mga5
ntp-client-4.2.6p5-24.2.mga5
ntp-doc-4.2.6p5-24.2.mga5

from ntp-4.2.6p5-24.2.mga5.src.rpm

Reproducible: 

Steps to Reproduce:
David Walser 2015-10-22 20:41:07 CEST

Version: Cauldron => 5

Comment 1 David Walser 2015-10-23 17:22:48 CEST
Working fine on our main server here at work, Mageia 5 i586.

Whiteboard: (none) => MGA5-32-OK

Dave Hodgins 2015-10-25 22:19:42 CET

CC: (none) => davidwhodgins, sysadmin-bugs
Whiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK advisory
Keywords: (none) => validated_update

Comment 2 Mageia Robot 2015-10-25 22:51:20 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0413.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 3 David Walser 2015-10-26 20:59:34 CET
LWN reference for CVE-2015-5300:
http://lwn.net/Vulnerabilities/662065/
Comment 4 Liam Hellen 2023-11-01 09:37:21 CET Comment hidden (spam)

CC: (none) => liamhellen55

Comment 5 guru blori 2024-01-20 14:39:51 CET Comment hidden (spam)

CC: (none) => alinomi07

Dave Hodgins 2024-01-20 16:14:27 CET

CC: alinomi07, liamhellen55 => (none)

Comment 6 Thomas Tate 2024-05-11 09:45:14 CEST Comment hidden (spam)

CC: (none) => tiveg92301

Ben McMonagle 2024-05-11 10:17:28 CEST

CC: tiveg92301 => westel

Comment 7 Fes Cop 2024-07-15 09:55:12 CEST Comment hidden (spam)

CC: (none) => vokikox565

Comment 8 Fes Cop 2024-07-15 09:55:48 CEST Comment hidden (spam)
Ben McMonagle 2024-07-15 10:04:06 CEST

CC: vokikox565 => (none)


Note You need to log in before you can comment on or make changes to this bug.