Executive Summary
Summary | |
---|---|
Title | ntp security update |
Informations | |||
---|---|---|---|
Name | DSA-3388 | First vendor Publication | 2015-11-01 |
Vendor | Debian | Last vendor Modification | 2015-11-01 |
Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
---|---|---|---|
Cvss Base Score | 7.8 | Attack Range | Network |
Cvss Impact Score | 6.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs: CVE-2015-5146 A flaw was found in the way ntpd processed certain remote configuration packets. An attacker could use a specially crafted package to cause ntpd to crash if: * ntpd enabled remote configuration * The attacker had the knowledge of the configuration password * The attacker had access to a computer entrusted to perform remote configuration Note that remote configuration is disabled by default in NTP. CVE-2015-5194 It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands. CVE-2015-5195 It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g. timingstats) is referenced by the statistics or filegen configuration command CVE-2015-5219 It was discovered that sntp program would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double. CVE-2015-5300 It was found that ntpd did not correctly implement the -g option: Normally, ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, ntpd will exit with a message to the system log. This option can be used with the -q and -x options. ntpd could actually step the clock multiple times by more than the panic threshold if its clock discipline doesn't have enough time to reach the sync state and stay there for at least one update. If a man-in-the-middle attacker can control the NTP traffic since ntpd was started (or maybe up to 15-30 minutes after that), they can prevent the client from reaching the sync state and force it to step its clock by any amount any number of times, which can be used by attackers to expire certificates, etc. This is contrary to what the documentation says. Normally, the assumption is that an MITM attacker can step the clock more than the panic threshold only once when ntpd starts and to make a larger adjustment the attacker has to divide it into multiple smaller steps, each taking 15 minutes, which is slow. CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. Receipt of these packets can cause ntpd to crash. CVE-2015-7701 A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory. CVE-2015-7703 Miroslav Lichvar of Red Hat found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals). For example: ntpq -c ':config pidfile /tmp/ntp.pid' ntpq -c ':config driftfile /tmp/ntp.drift' In Debian ntpd is configured to drop root privileges, which limits the impact of this issue. CVE-2015-7704 If ntpd as an NTP client receives a Kiss-of-Death (KoD) packet from the server to reduce its polling rate, it doesn't check if the originate timestamp in the reply matches the transmit timestamp from its request. An off-path attacker can send a crafted KoD packet to the client, which will increase the client's polling interval to a large value and effectively disable synchronization with the server. CVE-2015-7850 An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability. CVE-2015-7852 A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds. CVE-2015-7855 It was found that NTP's decodenetnum() would abort with an assertion failure when processing a mode 6 or mode 7 packet containing an unusually long data value where a network address was expected. This could allow an authenticated attacker to crash ntpd. CVE-2015-7871 An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time. For the oldstable distribution (wheezy), these problems have been fixed in version 1:4.2.6.p5+dfsg-2+deb7u6. For the stable distribution (jessie), these problems have been fixed in version 1:4.2.6.p5+dfsg-7+deb8u1. For the testing distribution (stretch), these problems have been fixed in version 1:4.2.8p4+dfsg-3. For the unstable distribution (sid), these problems have been fixed in version 1:4.2.8p4+dfsg-3. We recommend that you upgrade your ntp packages. |
Original Source
Url : http://www.debian.org/security/2015/dsa-3388 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
71 % | CWE-20 | Improper Input Validation |
6 % | CWE-772 | Missing Release of Resource after Effective Lifetime |
6 % | CWE-704 | Incorrect Type Conversion or Cast |
6 % | CWE-361 | Time and State |
6 % | CWE-331 | Insufficient Entropy |
6 % | CWE-287 | Improper Authentication |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-12-20 | NTP origin timestamp denial of service attempt RuleID : 40811 - Revision : 4 - Type : SERVER-OTHER |
2016-03-14 | NTP arbitrary pidfile and driftfile overwrite attempt RuleID : 37526 - Revision : 3 - Type : SERVER-OTHER |
2016-03-14 | NTP arbitrary pidfile and driftfile overwrite attempt RuleID : 37525 - Revision : 4 - Type : SERVER-OTHER |
2016-03-14 | NTP decodenetnum assertion failure denial of service attempt RuleID : 36633 - Revision : 3 - Type : SERVER-OTHER |
2016-03-14 | NTP decodenetnum assertion failure denial of service attempt RuleID : 36632 - Revision : 3 - Type : SERVER-OTHER |
2016-03-14 | NTP crypto-NAK packet flood attempt RuleID : 36536 - Revision : 5 - Type : SERVER-OTHER |
2015-10-01 | ntpd remote configuration denial of service attempt RuleID : 36252 - Revision : 4 - Type : SERVER-OTHER |
2015-10-01 | ntpq atoascii memory corruption attempt RuleID : 36251 - Revision : 4 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2018-05-11 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2018-1009.nasl - Type : ACT_GATHER_INFO |
2018-05-11 | Name : The remote Amazon Linux 2 host is missing a security update. File : al2_ALAS-2018-1009.nasl - Type : ACT_GATHER_INFO |
2018-01-03 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17114.nasl - Type : ACT_GATHER_INFO |
2017-08-09 | Name : The remote AIX host has a version of NTP installed that is affected by a data... File : aix_ntp_v4_advisory5.nasl - Type : ACT_GATHER_INFO |
2017-08-09 | Name : The remote AIX host has a version of NTP installed that is affected by multip... File : aix_ntp_v4_advisory4.nasl - Type : ACT_GATHER_INFO |
2017-08-09 | Name : The remote AIX host has a version of NTP installed that is affected by multip... File : aix_ntp_v3_advisory4.nasl - Type : ACT_GATHER_INFO |
2017-05-01 | Name : The remote EulerOS host is missing multiple security updates. File : EulerOS_SA-2016-1060.nasl - Type : ACT_GATHER_INFO |
2017-03-01 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL02360853.nasl - Type : ACT_GATHER_INFO |
2017-02-01 | Name : The remote host is affected by multiple vulnerabilities. File : citrix_xenserver_CTX220112.nasl - Type : ACT_GATHER_INFO |
2017-01-24 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2017-0255-1.nasl - Type : ACT_GATHER_INFO |
2016-12-29 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-1525.nasl - Type : ACT_GATHER_INFO |
2016-12-21 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-3196-1.nasl - Type : ACT_GATHER_INFO |
2016-12-21 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-3193-1.nasl - Type : ACT_GATHER_INFO |
2016-12-21 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-3195-1.nasl - Type : ACT_GATHER_INFO |
2016-12-15 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20161103_ntp_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
2016-11-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-2583.nasl - Type : ACT_GATHER_INFO |
2016-11-11 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-2583.nasl - Type : ACT_GATHER_INFO |
2016-11-04 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-2583.nasl - Type : ACT_GATHER_INFO |
2016-08-29 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1912-1.nasl - Type : ACT_GATHER_INFO |
2016-07-21 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201607-15.nasl - Type : ACT_GATHER_INFO |
2016-06-17 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1568-1.nasl - Type : ACT_GATHER_INFO |
2016-06-09 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20160510_ntp_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2016-06-03 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17528.nasl - Type : ACT_GATHER_INFO |
2016-06-01 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2016-0082.nasl - Type : ACT_GATHER_INFO |
2016-06-01 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-649.nasl - Type : ACT_GATHER_INFO |
2016-05-26 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17515.nasl - Type : ACT_GATHER_INFO |
2016-05-25 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17529.nasl - Type : ACT_GATHER_INFO |
2016-05-25 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17517.nasl - Type : ACT_GATHER_INFO |
2016-05-20 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-599.nasl - Type : ACT_GATHER_INFO |
2016-05-19 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1311-1.nasl - Type : ACT_GATHER_INFO |
2016-05-17 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2016-0780.nasl - Type : ACT_GATHER_INFO |
2016-05-16 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1291-1.nasl - Type : ACT_GATHER_INFO |
2016-05-16 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2016-0780.nasl - Type : ACT_GATHER_INFO |
2016-05-13 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1278-1.nasl - Type : ACT_GATHER_INFO |
2016-05-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2016-578.nasl - Type : ACT_GATHER_INFO |
2016-05-12 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2016-0780.nasl - Type : ACT_GATHER_INFO |
2016-05-09 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1247-1.nasl - Type : ACT_GATHER_INFO |
2016-05-05 | Name : The remote NTP server is affected by multiple vulnerabilities. File : ntp_4_2_8p7.nasl - Type : ACT_GATHER_INFO |
2016-05-02 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1177-1.nasl - Type : ACT_GATHER_INFO |
2016-05-02 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2016-1175-1.nasl - Type : ACT_GATHER_INFO |
2016-05-02 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-120-01.nasl - Type : ACT_GATHER_INFO |
2016-04-27 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_b2487d9a0c3011e6acd0d050996490d0.nasl - Type : ACT_GATHER_INFO |
2016-04-07 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201604-03.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2016-34bc10a2c8.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2015-f5f5ec7b6b.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote Fedora host is missing a security update. File : fedora_2015-77bfbc1bcd.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote AIX host is missing a security patch. File : aix_ntp_advisory5.nasl - Type : ACT_GATHER_INFO |
2016-02-24 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2016-054-04.nasl - Type : ACT_GATHER_INFO |
2016-02-24 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL10600056.nasl - Type : ACT_GATHER_INFO |
2016-02-18 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17516.nasl - Type : ACT_GATHER_INFO |
2016-01-28 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17518.nasl - Type : ACT_GATHER_INFO |
2016-01-22 | Name : The remote AIX host is missing a security patch. File : aix_IV79946.nasl - Type : ACT_GATHER_INFO |
2016-01-22 | Name : The remote AIX host is missing a security patch. File : aix_IV79945.nasl - Type : ACT_GATHER_INFO |
2016-01-22 | Name : The remote AIX host is missing a security patch. File : aix_IV79944.nasl - Type : ACT_GATHER_INFO |
2016-01-22 | Name : The remote AIX host is missing a security patch. File : aix_IV79943.nasl - Type : ACT_GATHER_INFO |
2016-01-22 | Name : The remote AIX host is missing a security patch. File : aix_IV79942.nasl - Type : ACT_GATHER_INFO |
2016-01-21 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL60352002.nasl - Type : ACT_GATHER_INFO |
2016-01-08 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_4eae4f46b5ce11e58a2bd050996490d0.nasl - Type : ACT_GATHER_INFO |
2015-12-22 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151119_ntp_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
2015-12-02 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-2231.nasl - Type : ACT_GATHER_INFO |
2015-11-30 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2520.nasl - Type : ACT_GATHER_INFO |
2015-11-24 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-2231.nasl - Type : ACT_GATHER_INFO |
2015-11-23 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-2058-1.nasl - Type : ACT_GATHER_INFO |
2015-11-20 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2231.nasl - Type : ACT_GATHER_INFO |
2015-11-20 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-767.nasl - Type : ACT_GATHER_INFO |
2015-11-06 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17566.nasl - Type : ACT_GATHER_INFO |
2015-11-06 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL17530.nasl - Type : ACT_GATHER_INFO |
2015-11-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3388.nasl - Type : ACT_GATHER_INFO |
2015-10-30 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2015-302-03.nasl - Type : ACT_GATHER_INFO |
2015-10-29 | Name : The remote Debian host is missing a security update. File : debian_DLA-335.nasl - Type : ACT_GATHER_INFO |
2015-10-29 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-607.nasl - Type : ACT_GATHER_INFO |
2015-10-28 | Name : The remote NTP server is affected by multiple vulnerabilities. File : ntp_4_2_8p4.nasl - Type : ACT_GATHER_INFO |
2015-10-28 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2783-1.nasl - Type : ACT_GATHER_INFO |
2015-10-27 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151026_ntp_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2015-10-27 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-1930.nasl - Type : ACT_GATHER_INFO |
2015-10-27 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2015-0140.nasl - Type : ACT_GATHER_INFO |
2015-10-27 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-1930.nasl - Type : ACT_GATHER_INFO |
2015-10-27 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-1930.nasl - Type : ACT_GATHER_INFO |
2015-10-22 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_c4a18a1277fc11e5a687206a8a720317.nasl - Type : ACT_GATHER_INFO |
2015-10-12 | Name : The remote Fedora host is missing a security update. File : fedora_2015-14212.nasl - Type : ACT_GATHER_INFO |
2015-10-05 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16393.nasl - Type : ACT_GATHER_INFO |
2015-09-25 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201509-01.nasl - Type : ACT_GATHER_INFO |
2015-09-21 | Name : The remote Fedora host is missing a security update. File : fedora_2015-14213.nasl - Type : ACT_GATHER_INFO |
2015-09-16 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL16392.nasl - Type : ACT_GATHER_INFO |
2015-09-03 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-593.nasl - Type : ACT_GATHER_INFO |
2015-08-04 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150722_ntp_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2015-07-31 | Name : The remote OracleVM host is missing one or more security updates. File : oraclevm_OVMSA-2015-0102.nasl - Type : ACT_GATHER_INFO |
2015-07-30 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-1459.nasl - Type : ACT_GATHER_INFO |
2015-07-28 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-1459.nasl - Type : ACT_GATHER_INFO |
2015-07-23 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-1459.nasl - Type : ACT_GATHER_INFO |
2015-07-08 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2015-188-03.nasl - Type : ACT_GATHER_INFO |
2015-07-06 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1173-1.nasl - Type : ACT_GATHER_INFO |
2015-05-21 | Name : The remote NTP server is affected by multiple vulnerabilities. File : ntp_4_2_8p2.nasl - Type : ACT_GATHER_INFO |
2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0865-1.nasl - Type : ACT_GATHER_INFO |
2015-04-29 | Name : The remote Fedora host is missing a security update. File : fedora_2015-5830.nasl - Type : ACT_GATHER_INFO |
2015-04-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3223.nasl - Type : ACT_GATHER_INFO |
2015-03-20 | Name : The remote NTP server is affected by multiple vulnerabilities. File : ntp_4_2_8.nasl - Type : ACT_GATHER_INFO |
2015-02-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3154.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2017-08-25 05:24:05 |
|
2017-08-15 21:25:24 |
|
2017-08-09 21:25:22 |
|
2017-07-27 17:23:59 |
|
2017-07-21 21:25:09 |
|
2015-11-03 13:24:41 |
|
2015-11-02 00:21:30 |
|