Rapid7 Vulnerability & Exploit Database

SUSE: CVE-2015-7704: SUSE Linux Security Advisory

Back to Search

SUSE: CVE-2015-7704: SUSE Linux Security Advisory

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:N/I:N/A:C)
Published
10/27/2015
Created
07/25/2018
Added
12/18/2015
Modified
03/21/2018

Description

Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.

From USN-2783-1:

Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-5146)

Miroslav Lichvar discovered that NTP incorrectly handled logconfig directives. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-5194)

Miroslav Lichvar discovered that NTP incorrectly handled certain statistics types. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-5195)

Miroslav Lichvar discovered that NTP incorrectly handled certain file paths. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service, or overwrite certain files. (CVE-2015-5196,CVE-2015-7703)

Miroslav Lichvar discovered that NTP incorrectly handled certain packets. A remote attacker could possibly use this issue to cause NTP to hang, resulting in a denial of service. (CVE-2015-5219)

Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP incorrectly handled restarting after hitting a panic threshold. A remote attacker could possibly use this issue to alter the system time on clients. (CVE-2015-5300)

It was discovered that NTP incorrectly handled autokey data packets. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7691,CVE-2015-7692,CVE-2015-7702)

It was discovered that NTP incorrectly handled memory when processing certain autokey messages. A remote attacker could possibly use this issue to cause NTP to consume memory, resulting in a denial of service. (CVE-2015-7701)

Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP incorrectly handled rate limiting. A remote attacker could possibly use this issue to cause clients to stop updating their clock. (CVE-2015-7704, CVE-2015-7705)

Yves Younan discovered that NTP incorrectly handled logfile and keyfile directives. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to enter a loop, resulting in a denial of service. (CVE-2015-7850)

Yves Younan and Aleksander Nikolich discovered that NTP incorrectly handled ascii conversion. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7852)

Yves Younan discovered that NTP incorrectly handled reference clock memory. A malicious refclock could possibly use this issue to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-7853)

John D "Doug" Birdwell discovered that NTP incorrectly handled decoding certain bogus values. An attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-7855)

Stephen Gray discovered that NTP incorrectly handled symmetric association authentication. A remote attacker could use this issue to possibly bypass authentication and alter the system clock. (CVE-2015-7871)

In the default installation, attackers would be isolated by the NTP AppArmor profile.

From DSA-3388:

Several vulnerabilities were discovered in the Network Time Protocol

daemon and utility programs:

From SUSE_CVE-2015-7704:

This CVE is addressed in the SUSE advisories SUSE-SU-2015:2058-1, openSUSE-SU-2015:2016-1

From ALAS-2015-607:

It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and effectively disable synchronization with the server. (CVE-2015-7704)

It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. A man-in-the-middle attacker able to intercept NTP traffic between a connecting client and an NTP server could use this flaw to force that client to make multiple steps larger than the panic threshold, effectively changing the time to an arbitrary value. (CVE-2015-5300)

It was found that the fix forCVE-2014-9750was incomplete: three issues were found in the value length checks in ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. Receipt of these packets can cause ntpd to crash. (CVE-2015-7691,CVE-2015-7692,CVE-2015-7702)

A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. (CVE-2015-7852)

A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory. (CVE-2015-7701)

From ELSA-2016-0780:

[4.2.6p5-10] - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138) - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978) [4.2.6p5-9] - fix crash with invalid logconfig command (CVE-2015-5194) - fix crash when referencing disabled statistic type (CVE-2015-5195) - don't hang in sntp with crafted reply (CVE-2015-5219) - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702) - fix memory leak with autokey (CVE-2015-7701) - don't allow setting driftfile and pidfile remotely (CVE-2015-7703) - don't crash in ntpq with crafted packet (CVE-2015-7852) - add option to set Differentiated Services Code Point (DSCP) (#1228314) - extend rawstats log (#1242895) - fix resetting of leap status (#1243034) - report clock state changes related to leap seconds (#1242937) - allow -4/-6 on restrict lines with mask (#1232146) - retry joining multicast groups (#1288534) - explain synchronised state in ntpstat man page (#1286969) [4.2.6p5-7] - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704) - allow only one step larger than panic threshold with -g (CVE-2015-5300)

From CESA-2015:1930:

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and effectively disable synchronization with the server. (CVE-2015-7704)

It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. A man-in-the-middle attacker able to intercept NTP traffic between a connecting client and an NTP server could use this flaw to force that client to make multiple steps larger than the panic threshold, effectively changing the time to an arbitrary value. (CVE-2015-5300)

Red Hat would like to thank Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg of Boston University for reporting these issues.

All ntp users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. After installing the update, the ntpd daemon will restart automatically.

From RHSA-2015:2520:

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and effectively disable synchronization with the server. (CVE-2015-7704)

Red Hat would like to thank Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg of Boston University for reporting this issue.

All ntp users are advised to upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing the update, the ntpd daemon will restart automatically.

From VID-B2487D9A-0C30-11E6-ACD0-D050996490D0:

Network Time Foundation reports:

NTF's NTP Project has been notified of the following low-

and medium-severity vulnerabilities that are fixed in

ntp-4.2.8p7, released on Tuesday, 26 April 2016:

Bug 3020 / CVE-2016-1551: Refclock impersonation

vulnerability, AKA: refclock-peering. Reported by

Matt Street and others of Cisco ASIG

Bug 3012 / CVE-2016-1549: Sybil vulnerability:

ephemeral association attack, AKA: ntp-sybil -

MITIGATION ONLY. Reported by Matthew Van Gundy

of Cisco ASIG

Bug 3011 / CVE-2016-2516: Duplicate IPs on

unconfig directives will cause an assertion botch.

Reported by Yihan Lian of the Cloud Security Team,

Qihoo 360

Bug 3010 / CVE-2016-2517: Remote configuration

trustedkey/requestkey values are not properly

validated. Reported by Yihan Lian of the Cloud

Security Team, Qihoo 360

Bug 3009 / CVE-2016-2518: Crafted addpeer with

hmode > 7 causes array wraparound with MATCH_ASSOC.

Reported by Yihan Lian of the Cloud Security Team,

Qihoo 360

Bug 3008 / CVE-2016-2519: ctl_getitem() return

value not always checked. Reported by Yihan Lian

of the Cloud Security Team, Qihoo 360

Bug 3007 / CVE-2016-1547: Validate crypto-NAKs,

AKA: nak-dos. Reported by Stephen Gray and

Matthew Van Gundy of Cisco ASIG

Bug 2978 / CVE-2016-1548: Interleave-pivot -

MITIGATION ONLY. Reported by Miroslav Lichvar of

RedHat and separately by Jonathan Gardner of

Cisco ASIG.

Bug 2952 / CVE-2015-7704: KoD fix: peer

associations were broken by the fix for

NtpBug2901, AKA: Symmetric active/passive mode

is broken. Reported by Michael Tatarinov,

NTP Project Developer Volunteer

Bug 2945 / Bug 2901 / CVE-2015-8138: Zero

Origin Timestamp Bypass, AKA: Additional KoD Checks.

Reported by Jonathan Gardner of Cisco ASIG

Bug 2879 / CVE-2016-1550: Improve NTP security

against buffer comparison timing attacks,

authdecrypt-timing, AKA: authdecrypt-timing.

Reported independently by Loganaden Velvindron,

and Matthew Van Gundy and Stephen Gray of

Cisco ASIG.

From VID-C4A18A12-77FC-11E5-A687-206A8A720317:

ntp.org reports:

NTF's NTP Project has been notified of the following 13 low-

and medium-severity vulnerabilities that are fixed in

ntp-4.2.8p4, released on Wednesday, 21 October 2015:

Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric

association authentication bypass via crypto-NAK

(Cisco ASIG)

Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch

instead of returning FAIL on some bogus values (IDA)

Bug 2921 CVE-2015-7854 Password Length Memory Corruption

Vulnerability. (Cisco TALOS)

Bug 2920 CVE-2015-7853 Invalid length data provided by a

custom refclock driver could cause a buffer overflow.

(Cisco TALOS)

Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption

Vulnerability. (Cisco TALOS)

Bug 2918 CVE-2015-7851 saveconfig Directory Traversal

Vulnerability. (OpenVMS) (Cisco TALOS)

Bug 2917 CVE-2015-7850 remote config logfile-keyfile.

(Cisco TALOS)

Bug 2916 CVE-2015-7849 trusted key use-after-free.

(Cisco TALOS)

Bug 2913 CVE-2015-7848 mode 7 loop counter underrun.

(Cisco TALOS)

Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC.

(Tenable)

Bug 2902 : CVE-2015-7703 configuration directives "pidfile"

and "driftfile" should only be allowed locally. (RedHat)

Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that

receive a KoD should validate the origin timestamp field.

(Boston University)

Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702

Incomplete autokey data packet length checks. (Tenable)

The only generally-exploitable bug in the above list is the

crypto-NAK bug, which has a CVSS2 score of 6.4.

Additionally, three bugs that have already been fixed in

ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd

have a security component, but are all below 1.8 CVSS score,

so we're reporting them here:

Bug 2382 : Peer precision < -31 gives division by zero

Bug 1774 : Segfaults if cryptostats enabled when built

without OpenSSL

Bug 1593 : ntpd abort in free() with logconfig syntax error

From SOL17566:

An off-path attacker can send a crafted Kiss of Death (KoD) packet to the client, which will increase the client's polling interval to a large value and effectively disable synchronization with the server.

From DLA-335-1:

ntp - security update

Solution(s)

  • suse-upgrade-ntp
  • suse-upgrade-ntp-debuginfo
  • suse-upgrade-ntp-debugsource
  • suse-upgrade-ntp-doc
  • suse-upgrade-yast2-ntp-client
  • suse-upgrade-yast2-ntp-client-devel-doc

References

  • suse-upgrade-ntp
  • suse-upgrade-ntp-debuginfo
  • suse-upgrade-ntp-debugsource
  • suse-upgrade-ntp-doc
  • suse-upgrade-yast2-ntp-client
  • suse-upgrade-yast2-ntp-client-devel-doc

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;