Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2016:1329-1

Опубликовано: 18 мая 2016
Источник: suse-cvrf

Описание

Security update for ntp

This update for ntp to 4.2.8p7 fixes the following issues:

  • CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA: CRYPTO-NAK DoS.
  • CVE-2016-1548, bsc#977461: Interleave-pivot
  • CVE-2016-1549, bsc#977451: Sybil vulnerability: ephemeral association attack.
  • CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks.
  • CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability
  • CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd.
  • CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated.
  • CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC.
  • CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked.
  • This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974

Bugs fixed:

  • Restrict the parser in the startup script to the first occurrance of 'keys' and 'controlkey' in ntp.conf (bsc#957226).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Список пакетов

openSUSE Leap 42.1
ntp-4.2.8p7-21.1
ntp-doc-4.2.8p7-21.1

Ссылки

Описание

The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки

Описание

ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL value.

Затронутые продукты
openSUSE Leap 42.1:ntp-4.2.8p7-21.1
openSUSE Leap 42.1:ntp-doc-4.2.8p7-21.1
Ссылки
Уязвимость openSUSE-SU-2016:1329-1