自定义 refclock 驱动程序提供的无效长度数据可造成缓冲区溢出

The remote AIX host has a version of Network Time Protocol (NTP) installed that is affected by the following vulnerabilities :

  - A divide-by-zero error exists in file include/ntp.h     when handling LOGTOD and ULOGTOD macros in a crafted     NTP packet. An unauthenticated, remote attacker can     exploit this, via crafted NTP packets, to crash ntpd.
    (CVE 2015-5219)

  - A flaw exists in the ntp_crypto.c file due to improper     validation of the 'vallen' value in extension fields. An     unauthenticated, remote attacker can exploit this, via     specially crafted autokey packets, to disclose     sensitive information or cause a denial of service.
    (CVE-2015-7691)

  - A denial of service vulnerability exists in the autokey     functionality due to a failure in the crypto_bob2(),     crypto_bob3(), and cert_sign() functions to properly     validate the 'vallen' value. An unauthenticated, remote     attacker can exploit this, via specially crafted autokey     packets, to crash the NTP service. (CVE-2015-7692)

  - A denial of service vulnerability exists in the     crypto_recv() function in the file ntp_crypto.c related     to autokey functionality. An unauthenticated, remote     attacker can exploit this, via an ongoing flood of NTPv4     autokey requests, to exhaust memory resources.
    (CVE-2015-7701)

  - A denial of service vulnerability exists due to improper     validation of packets containing certain autokey     operations. An unauthenticated, remote attacker can     exploit this, via specially crafted autokey packets,     to crash the NTP service. (CVE-2015-7702)

  - A denial of service vulnerability exists due to a logic     flaw in the authreadkeys() function in the file     authreadkeys.c when handling extended logging where the     log and key files are set to be the same file. An     authenticated, remote attacker can exploit this, via a     crafted set of remote configuration requests, to cause     the NTP service to stop responding. (CVE-2015-7850)

  - A overflow condition exists in the     read_refclock_packet() function in the file ntp_io.c     when handling negative data lengths. A local attacker     can exploit this to crash the NTP service or possibly     gain elevated privileges. (CVE-2015-7853)

  - A denial of service vulnerability exists due to an     assertion flaw in the decodenetnum() function in the     file decodenetnum.c when handling long data values in     mode 6 and 7 packets. An unauthenticated, remote     attacker can exploit this to crash the NTP service.
    (CVE-2015-7855)

ntp.org reports :

NTF's NTP Project has been notified of the following 13 low- and medium-severity vulnerabilities that are fixed in ntp-4.2.8p4, released on Wednesday, 21 October 2015 :

- Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric association authentication bypass via crypto-NAK (Cisco ASIG)

- Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (IDA)

- Bug 2921 CVE-2015-7854 Password Length Memory Corruption Vulnerability. (Cisco TALOS)

- Bug 2920 CVE-2015-7853 Invalid length data provided by a custom refclock driver could cause a buffer overflow. (Cisco TALOS)

- Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability. (Cisco TALOS)

- Bug 2918 CVE-2015-7851 saveconfig Directory Traversal Vulnerability.
(OpenVMS) (Cisco TALOS)

- Bug 2917 CVE-2015-7850 remote config logfile-keyfile. (Cisco TALOS)

- Bug 2916 CVE-2015-7849 trusted key use-after-free. (Cisco TALOS)

- Bug 2913 CVE-2015-7848 mode 7 loop counter underrun. (Cisco TALOS)

- Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC. (Tenable)

- Bug 2902 : CVE-2015-7703 configuration directives 'pidfile' and 'driftfile' should only be allowed locally. (RedHat)

- Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should validate the origin timestamp field. (Boston University)

- Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey data packet length checks. (Tenable)

The only generally-exploitable bug in the above list is the crypto-NAK bug, which has a CVSS2 score of 6.4.

Additionally, three bugs that have already been fixed in ntp-4.2.8 but were not fixed in ntp-4.2.6 as it was EOL'd have a security component, but are all below 1.8 CVSS score, so we're reporting them here :

- Bug 2382 : Peer precision < -31 gives division by zero

- Bug 1774 : Segfaults if cryptostats enabled when built without OpenSSL

- Bug 1593 : ntpd abort in free() with logconfig syntax error

ntp was updated to version 4.2.8p6 to fix 28 security issues.

Major functional changes :

  - The 'sntp' commandline tool changed its option handling     in a major way, some options have been renamed or     dropped.

  - 'controlkey 1' is added during update to ntp.conf to     allow sntp to work.

  - The local clock is being disabled during update.

  - ntpd is no longer running chrooted.

Other functional changes :

  - ntp-signd is installed.

  - 'enable mode7' can be added to the configuration to     allow ntdpc to work as compatibility mode option.

  - 'kod' was removed from the default restrictions.

  - SHA1 keys are used by default instead of MD5 keys.

Also yast2-ntp-client was updated to match some sntp syntax changes.
(bsc#937837)

These security issues were fixed :

  - CVE-2015-8158: Fixed potential infinite loop in ntpq     (bsc#962966).

  - CVE-2015-8138: Zero Origin Timestamp Bypass     (bsc#963002).

  - CVE-2015-7979: Off-path Denial of Service (DoS) attack     on authenticated broadcast mode (bsc#962784).

  - CVE-2015-7978: Stack exhaustion in recursive traversal     of restriction list (bsc#963000).

  - CVE-2015-7977: reslist NULL pointer dereference     (bsc#962970).

  - CVE-2015-7976: ntpq saveconfig command allows dangerous     characters in filenames (bsc#962802).

  - CVE-2015-7975: nextvar() missing length check     (bsc#962988).

  - CVE-2015-7974: Skeleton Key: Missing key check allows     impersonation between authenticated peers (bsc#962960).

  - CVE-2015-7973: Replay attack on authenticated broadcast     mode (bsc#962995).

  - CVE-2015-8140: ntpq vulnerable to replay attacks     (bsc#962994).

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin (bsc#962997).

  - CVE-2015-5300: MITM attacker could have forced ntpd to     make a step larger than the panic threshold     (bsc#951629).

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK (bsc#951608).

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values (bsc#951608).

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow     (bsc#951608).

  - CVE-2015-7852: ntpq atoascii() Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7851: saveconfig Directory Traversal     Vulnerability (bsc#951608).

  - CVE-2015-7850: remote config logfile-keyfile     (bsc#951608).

  - CVE-2015-7849: trusted key use-after-free (bsc#951608).

  - CVE-2015-7848: mode 7 loop counter underrun     (bsc#951608).

  - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC     (bsc#951608).

  - CVE-2015-7703: configuration directives 'pidfile' and     'driftfile' should only be allowed locally (bsc#951608).

  - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD     should validate the origin timestamp field (bsc#951608).

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete     autokey data packet length checks (bsc#951608).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that ntpd did not check whether a Message     Authentication Code (MAC) was present in a received     packet when ntpd was configured to use symmetric     cryptographic keys. A man-in-the-middle attacker could     use this flaw to send crafted packets that would be     accepted by a client or a peer without the attacker     knowing the symmetric key.(CVE-2015-1798)

  - A missing return statement in the receive() function     could potentially allow a remote attacker to bypass     NTP's authentication mechanism.(CVE-2014-9296)

  - The rate limiting feature in NTP 4.x before 4.2.8p4 and     4.3.x before 4.3.77 allows remote attackers to have     unspecified impact via a large number of crafted     requests.(CVE-2015-7705)

  - The datalen parameter in the refclock driver in NTP     4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows     remote attackers to execute arbitrary code or cause a     denial of service (crash) via a negative input     value.(CVE-2015-7853)

  - Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4,     and 4.3.x before 4.3.77 allows remote attackers to     bypass authentication.(CVE-2015-7871)

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows     a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a     zero-origin timestamp and source IP address of the     ''other side'' of an interleaved association causing     the victim ntpd to reset its     association.(CVE-2018-7185)

  - The ntpq saveconfig command in NTP 4.1.2, 4.2.x before     4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not     properly filter special characters, which allows     attackers to cause unspecified impact via a crafted     filename.(CVE-2015-7976)

  - ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before     4.3.77 allows remote authenticated users to cause a     denial of service (infinite loop or crash) by pointing     the key file at the log file.(CVE-2015-7850)

  - The decodenetnum function in ntpd in NTP 4.2.x before     4.2.8p4, and 4.3.x before 4.3.77 allows remote     attackers to cause a denial of service (assertion     failure) via a 6 or mode 7 packet containing a long     data value.(CVE-2015-7855)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

远程 AIX 主机上安装的的网络时间协议 (NTP) 版本受到下列漏洞影响：- 处理特制 NTP 数据包中的 LOGTOD 和 ULOGTOD 宏命令时，文件 include/ntp.h 中有除零错误。未经身份验证的远程攻击者可利用此漏洞，通过特制的 NTP 数据包造成 ntpd 崩溃。(CVE 2015-5219) - 由于未正确验证扩展字段中的“vallen”值，ntp_crypto.c 文件中存在一个缺陷。未经认证的远程攻击者可利用此缺陷，通过特制的 autokey 数据包泄露敏感信息或造成拒绝服务。(CVE-2015-7691) - 由于 crypto_bob2()、crypto_bob3() 和 cert_sign() 函数未正确验证“vallen”值，autokey 功能中存在一个拒绝服务漏洞。未经认证的远程攻击者可利用此情况，通过特制的 autokey 数据包，使 NTP 服务崩溃。(CVE-2015-7692) - 与 autokey 功能相关的 ntp_crypto.c 文件的 crypto_recv() 函数中存在一个拒绝服务漏洞。未经认证的远程攻击者可利用此漏洞，通过持续发送大量 NTPv4 autokey 请求来耗尽内存资源。(CVE-2015-7701) - 由于未正确验证包含特定 autokey 操作的数据包，存在一个拒绝服务漏洞。未经认证的远程攻击者可利用此情况，通过特制的 autokey 数据包，使 NTP 服务崩溃。(CVE-2015-7702) - 由于在处理将日志文件和密钥文件设置为同一文件的扩展日志记录时，authreadkeys.c 文件的 authreadkeys() 函数中存在一个逻辑缺陷，因此存在一个拒绝服务漏洞。经过认证的远程攻击者可利用此漏洞，通过一组构建的远程配置请求造成 NTP 服务停止响应。(CVE-2015-7850) - 处理负的数据长度时，ntp_io.c 文件的 read_refclock_packet() 函数中存在溢出情况。本地攻击者可利用此情况造成 NTP 服务崩溃，也可能获得提升的权限。(CVE-2015-7853) - 由于在处理模式 6 和 7 数据包中的长数据值时，decodenetnum.c 文件的 decodenetnum() 函数中存在一个断言缺陷，因此存在一个拒绝服务漏洞。未经认证的远程攻击者可利用此情况使 NTP 服务崩溃。(CVE-2015-7855)

ntp.org 报告：

NTF 的 NTP 项目已通知，2015 年 10 月 21 日星期三发布的 ntp-4.2.8p4 中修复了以下 13 个低危和中危严重性漏洞：

- 缺陷 2941 CVE-2015-7871 未来的 NAK：通过 crypto-NAK 进行的对称关联认证绕过 (Cisco ASIG)

- 缺陷 2922 CVE-2015-7855 对于某些虚假值，decodenetnum() 会 ASSERT botch，而不会返回 FAIL (IDA)

- 缺陷 2921 CVE-2015-7854 密码长度内存损坏漏洞。(Cisco TALOS)

- 缺陷 2920 CVE-2015-7853 自定义 refclock 驱动程序提供的无效长度数据可造成缓冲区溢出。(Cisco TALOS)

- 缺陷 2919 CVE-2015-7852 ntpq atoascii() 内存损坏漏洞。(Cisco TALOS)

- 缺陷 2918 CVE-2015-7851 saveconfig 目录遍历漏洞。
(OpenVMS) (Cisco TALOS)

- 缺陷 2917 CVE-2015-7850 远程配置 logfile-keyfile。(Cisco TALOS)

- 缺陷 2916 CVE-2015-7849 受信任密钥释放后使用。(Cisco TALOS)

- 缺陷 2913 CVE-2015-7848 模式 7 循环计数器欠载运行。(Cisco TALOS)

- 缺陷 2909 CVE-2015-7701 CRYPTO_ASSOC 中缓慢的内存泄漏。(Tenable)

- 缺陷 2902：CVE-2015-7703 配置指令“pidfile”和“driftfile”应仅在本地允许。(RedHat)

- 缺陷 2901：CVE-2015-7704、CVE-2015-7705 接收 KoD 的客户端应验证源时间戳字段。（波士顿大学）

- 缺陷 2899：CVE-2015-7691、CVE-2015-7692、CVE-2015-7702 autokey 数据包长度检查不完整。(Tenable)

上述列表中唯一可普遍利用的缺陷是 crypto-NAK 缺陷，它的 CVSS2 得分为 6.4。

此外，有三个缺陷已在 ntp-4.2.8 中修复，但是没有在 ntp-4.2.6 中修复（因为其生命周期已终止），它们有安全组件，但是 CVSS 得分都低于 1.8，因此在此处报告它们：

- 缺陷 2382：对等机精度 < -31 会触发除以零

- 缺陷 1774：不使用 OpenSSL 进行构建时，如果启用 cryptostats，则会产生段错误

- 缺陷 1593：出现 logconfig 语法错误，free() 中的 ntpd 中止

ntp 已更新到版本 4.2.8p6，修复了 28 个安全问题。

主要功能变更：

-“sntp”命令行工具大幅变更了其选项处理方式，已经重命名或终止了某些选项。

- 更新到 ntp.conf 期间添加“controlkey 1”以允许 sntp 运行。

- 更新期间禁用本地时钟。

- ntpd 不再运行 chrooted。

其他功能变更：

- 安装了 ntp-signd。

- 可添加“enable mode7”至配置，允许 ntdpc 作为兼容性模式选项运行。

- 删除默认限制中的“kod”。

- 默认使用 SHA1 密钥而非 MD5 密钥。

此外，也已更新 yast2-ntp-client 以与某些 sntp 语法变更相匹配。
(bsc#937837)

修复了这些安全问题：

- CVE-2015-8158：已修复 ntpq 中的潜在无限循环 (bsc#962966)。

- CVE-2015-8138：零来源时间戳绕过 (bsc#963002)。

- CVE-2015-7979：对经认证广播模式发动的路径外拒绝服务 (DoS) 攻击 (bsc#962784)。

- CVE-2015-7978：限制列表递归遍历中的堆栈耗尽 (bsc#963000)。

- CVE-2015-7977：reslist 空指针取消引用 (bsc#962970)。

- CVE-2015-7976：ntpq saveconfig 命令允许在文件名中存在危险字符 (bsc#962802)。

- CVE-2015-7975：nextvar() 缺少长度检查 (bsc#962988)。

- CVE-2015-7974：Skeleton Key：缺少密钥检查允许在经认证的对等机之间假冒 (bsc#962960)。

- CVE-2015-7973：对经认证的广播模式发动回放攻击 (bsc#962995)。

- CVE-2015-8140：ntpq 容易遭受回放攻击 (bsc#962994)。

- CVE-2015-8139：来源泄漏：ntpq 与 ntpdc，泄露来源 (bsc#962997)。

- CVE-2015-5300：MITM 攻击者可强制 ntpd 跨出大于错误阈值的一步 (bsc#951629)。

- CVE-2015-7871：未来的 NAK：通过 crypto-NAK 进行的对称关联认证绕过 (bsc#951608)。

- CVE-2015-7855：对于某些虚假值，decodenetnum() 会 ASSERT botch，而不会返回 FAIL (bsc#951608)。

- CVE-2015-7854：密码长度内存损坏漏洞 (bsc#951608)。

- CVE-2015-7853：自定义 refclock 驱动程序提供的无效长度数据可造成缓冲区溢出 (bsc#951608)。

- CVE-2015-7852：ntpq atoascii() 内存损坏漏洞 (bsc#951608)。

- CVE-2015-7851：saveconfig 目录遍历漏洞 (bsc#951608)。

- CVE-2015-7850：远程配置 logfile-keyfile (bsc#951608)。

- CVE-2015-7849：受信任密钥释放后使用 (bsc#951608)。

- CVE-2015-7848：模式 7 循环计数器欠载运行 (bsc#951608)。

- CVE-2015-7701：CRYPTO_ASSOC 中缓慢的内存泄漏 (bsc#951608)。

- CVE-2015-7703：配置指令“pidfile”和“driftfile”应仅在本地允许 (bsc#951608)。

- CVE-2015-7704、CVE-2015-7705：接收 KoD 的客户端应验证源时间戳字段 (bsc#951608)。

- CVE-2015-7691、CVE-2015-7692、CVE-2015-7702：autokey 数据包长度检查不完整 (bsc#951608)。

已修复下列非安全性问题：

- fate#320758 bsc#975981：对于 MS-SNTP 启用编译时间支持 (--enable-ntp-signd)。这会替换 4.2.4 中的 w32 修补程序，其添加了 authreg 指令。

- bsc#962318：以完整路径调用 /usr/sbin/sntp 以在 start-ntpd 中同步。当以 cron 工作身份运行时，/usr/sbin/ 不在路径中，其可造成同步失败。

- bsc#782060：加速 ntpq。

- bsc#916617：添加 /var/db/ntp-kod。

- bsc#956773：添加 ntp-ENOBUFS.patch 以限制可能在已加载系统上时常发生的警告。

- bsc#951559、bsc#975496：修复 sntp 在 DST 期间的 TZ 偏移输出。

- 添加 ntp-fork.patch 并在禁用线程的情况下构建以允许即使在运行 chrooted 时也进行名称解析。

- 向 /etc/ntp.conf 添加一个控制键行（如果此行尚不存在），以允许通过 ntpq 实现的运行时配置。

- bsc#946386：暂时禁用 memlock，避免名称解析期间因高内存使用率而发生问题。

- bsc#905885：为对称密钥使用 SHA1 而不是 MD5。

- 改进运行时配置：

- 从 ntp.conf 读取 keytype

- 不将 ntp 密钥写入到 syslog。

- 修复旧有操作脚本，传递命令行参数。

- bsc#944300：从 ntp.conf 中的限制行删除“kod”。

- bsc#936327：在 start-ntpd 中使用 ntpq 而不是已弃用的 ntpdc。

- 将 controlkey 添加到 ntp.conf 以进行上述工作。

- 不让 ntp.conf 中的“keysdir”行触发“keys”解析器。

- 再次禁用模式 7 (ntpdc)，因为我们不会再使用该模式。

- 添加“addserver”作为新的旧有操作。

- bsc#910063：修复有关 ntp.conf 中 addserver 的注释。

- bsc#926510：默认为禁用 chroot。

- bsc#920238：启用 ntpdc 支持向后兼容性。

请注意，Tenable Network Security 已直接从 SUSE 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value. (CVE-2015-7853)

Impact

Running a custom refclock driver in ntpd could overflow a data buffer under certain conditions. Running a custom installed refclock driver is not a supported configuration in F5 products.

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p4.
It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the ntp_crypto.c file due to improper     validation of the 'vallen' value in extension fields. An     unauthenticated, remote attacker can exploit this, via     specially crafted autokey packets, to disclose     sensitive information or cause a denial of service.
    (CVE-2015-7691)

  - A denial of service vulnerability exists in the autokey     functionality due to a failure in the crypto_bob2(),     crypto_bob3(), and cert_sign() functions to properly     validate the 'vallen' value. An unauthenticated, remote     attacker can exploit this, via specially crafted autokey     packets, to crash the NTP service. (CVE-2015-7692)

  - A denial of service vulnerability exists in the     crypto_recv() function in the file ntp_crypto.c related     to autokey functionality. An unauthenticated, remote     attacker can exploit this, via an ongoing flood of NTPv4     autokey requests, to exhaust memory resources.
    (CVE-2015-7701)

  - A denial of service vulnerability exists due to improper     validation of packets containing certain autokey     operations. An unauthenticated, remote attacker can     exploit this, via specially crafted autokey packets,     to crash the NTP service. (CVE-2015-7702)

  - A flaw exists related to the handling of the 'config:'     command. An authenticated, remote attacker can exploit     this to set the 'pidfile' and 'driftfile' directives     without restrictions, thus allowing the attacker to     overwrite arbitrary files. Note that exploitation of     this issue requires that remote configuration is enabled     for ntpd. (CVE-2015-7703)

  - A denial of service vulnerability exists due improper     validation of the origin timestamp when handling     Kiss-of-Death (KoD) packets. An unauthenticated, remote     attacker can exploit this to stop the client from     querying its servers, preventing it from updating its     clock. (CVE-2015-7704)

  - A denial of service vulnerability exists due to improper     implementation of rate-limiting when handling server     queries. An unauthenticated, remote attacker can exploit     this to stop the client from querying its servers,     preventing it from updating its clock. (CVE-2015-7705)

  - A denial of service vulnerability exists due to an     integer overflow condition in the reset_peer() function     in the file ntp_request.c when handling private mode     packets having request code RESET_PEER (0x16). An     authenticated, remote attacker can exploit this to crash     the NTP service. Note that exploitation of this issue     requires that ntpd is configured to enable mode 7     packets, and that the mode 7 packets are not properly     protected by available authentication and restriction     mechanisms. (CVE-2015-7848)

  - A use-after-free error exists in the auth_delkeys()     function in the file authkeys.c when handling trusted     keys. An authenticated, remote attacker can exploit this     to dereference already freed memory, resulting in a     crash of the NTP service or the execution of arbitrary     code. (CVE-2015-7849)

  - A denial of service vulnerability exists due to a logic     flaw in the authreadkeys() function in the file     authreadkeys.c when handling extended logging where the     log and key files are set to be the same file. An     authenticated, remote attacker can exploit this, via a     crafted set of remote configuration requests, to cause     the NTP service to stop responding. (CVE-2015-7850)

  - A flaw exists in the save_config() function in the file     ntp_control.c due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this issue, via a crafted set of     configuration requests, to overwrite arbitrary files.
    Note that this issue only affects VMS systems and     requires that ntpd is configured to allow remote     configuration. (CVE-2015-7851)

  - A denial of service vulnerability exists due to an     off-by-one overflow condition in the cookedprint()     function in the file ntpq.c when handling mode 6     response packets. An unauthenticated, remote attacker     can exploit this to crash the NTP service.
    (CVE-2015-7852)

  - A overflow condition exists in the     read_refclock_packet() function in the file ntp_io.c     when handling negative data lengths. A local attacker     can exploit this to crash the NTP service or possibly     gain elevated privileges. (CVE-2015-7853)

  - A heap-based overflow condition exists in function     MD5auth_setkey() in the file authkeys.c when handling     passwords. An authenticated, remote attacker can exploit     this, via a crafted set of configuration requests, to     crash the NTP service or possibly execute arbitrary     code. (CVE-2015-7854)

  - A denial of service vulnerability exists due to an     assertion flaw in the decodenetnum() function in the     file decodenetnum.c when handling long data values in     mode 6 and 7 packets. An unauthenticated, remote     attacker can exploit this to crash the NTP service.
    (CVE-2015-7855)

  - An authentication bypass vulnerability exists in the     receive() function in the file ntp_proto.c when handling     crypto-NAK packets. An unauthenticated, remote attacker     can exploit this to cause the service to accept time     from unauthenticated, ephemeral symmetric peers.
    (CVE-2015-7871)

This ntp update provides the following security and non security fixes :

  - Update to 4.2.8p4 to fix several security issues     (bsc#951608) :

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow

  - CVE-2015-7852 ntpq atoascii() Memory Corruption     Vulnerability

  - CVE-2015-7851 saveconfig Directory Traversal     Vulnerability

  - CVE-2015-7850 remote config logfile-keyfile

  - CVE-2015-7849 trusted key use-after-free

  - CVE-2015-7848 mode 7 loop counter underrun

  - CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC

  - CVE-2015-7703 configuration directives 'pidfile' and     'driftfile' should only be allowed locally

  - CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD     should validate the origin timestamp field

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete     autokey data packet length checks

  - obsoletes ntp-memlock.patch.

  - Add a controlkey line to /etc/ntp.conf if one does not     already exist to allow runtime configuuration via ntpq.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - The rate limiting feature in NTP 4.x before 4.2.8p4 and     4.3.x before 4.3.77 allows remote attackers to have     unspecified impact via a large number of crafted     requests.i1/4^CVE-2015-7705i1/4%0

  - The datalen parameter in the refclock driver in NTP     4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows     remote attackers to execute arbitrary code or cause a     denial of service (crash) via a negative input     value.i1/4^CVE-2015-7853i1/4%0

  - Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4,     and 4.3.x before 4.3.77 allows remote attackers to     bypass authentication.i1/4^CVE-2015-7871i1/4%0

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows     a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a     zero-origin timestamp and source IP address of the     'other side' of an interleaved association causing the     victim ntpd to reset its     association.i1/4^CVE-2018-7185i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The rate limiting feature in NTP 4.x before 4.2.8p4 and     4.3.x before 4.3.77 allows remote attackers to have     unspecified impact via a large number of crafted     requests.

  - Mitigation:Do not add the 'limited' configuration     option to any restrict lines in the ntp.conf     file.(CVE-2015-7705)

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows     a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a     zero-origin timestamp and source IP address of the     'other side' of an interleaved association causing the     victim ntpd to reset its association(CVE-2018-7185)

  - The ntpq saveconfig command in NTP 4.1.2, 4.2.x before     4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not     properly filter special characters, which allows     attackers to cause unspecified impact via a crafted     filename.(CVE-2015-7976)

  - ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before     4.3.77 allows remote authenticated users to cause a     denial of service (infinite loop or crash) by pointing     the key file at the log file.

  - Mitigation:Disable NTP remote configuration or limit     this feature to trusted users to effectively mitigate     this risk(CVE-2015-7850)

  - The datalen parameter in the refclock driver in NTP     4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows     remote attackers to execute arbitrary code or cause a     denial of service (crash) via a negative input     value.(CVE-2015-7853)

  - Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4,     and 4.3.x before 4.3.77 allows remote attackers to     bypass authentication.(CVE-2015-7871)

  - The decodenetnum function in ntpd in NTP 4.2.x before     4.2.8p4, and 4.3.x before 4.3.77 allows remote     attackers to cause a denial of service (assertion     failure) via a 6 or mode 7 packet containing a long     data value.(CVE-2015-7855)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote pfSense install is prior to 2.2.5. It is, therefore, affected by multiple vulnerabilities as stated in the referenced vendor advisories.

Multiple Cisco products incorporate a version of the ntpd package. Versions of this package are affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to create a denial of service (DoS) condition or modify the time being advertised by a device acting as a network time protocol (NTP) server. 

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91314	F5 Networks BIG-IP：NTP 漏洞 (SOL17525)	Nessus	F5 Networks Local Security Checks	2016/5/25	2020/3/9	critical
102322	AIX NTP v4 Advisory : ntp_advisory4.asc (IV79954) (IV79954)	Nessus	AIX Local Security Checks	2017/8/9	2023/4/21	high
86519	FreeBSD : ntp -- 13 low- and medium-severity vulnerabilities (c4a18a12-77fc-11e5-a687-206a8a720317)	Nessus	FreeBSD Local Security Checks	2015/10/22	2021/1/6	critical
90991	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:1247-1)	Nessus	SuSE Local Security Checks	2016/5/9	2021/1/6	critical
125010	EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1557)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
102322	AIX NTP v4 公告：ntp_advisory4.asc (IV79954) (IV79954)	Nessus	AIX Local Security Checks	2017/8/9	2023/4/21	high
86519	FreeBSD：ntp -- 13 个低危和中危严重性漏洞 (c4a18a12-77fc-11e5-a687-206a8a720317)	Nessus	FreeBSD Local Security Checks	2015/10/22	2021/1/6	critical
90991	SUSE SLED12 / SLES12 安全更新：ntp (SUSE-SU-2016:1247-1)	Nessus	SuSE Local Security Checks	2016/5/9	2021/1/6	critical
91314	F5 Networks BIG-IP : NTP vulnerability (K17525)	Nessus	F5 Networks Local Security Checks	2016/5/25	2020/3/9	critical
86631	Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p4 Multiple Vulnerabilities	Nessus	Misc.	2015/10/28	2019/11/20	critical
86964	openSUSE Security Update : ntp (openSUSE-2015-767)	Nessus	SuSE Local Security Checks	2015/11/20	2021/1/19	critical
123908	EulerOS Virtualization 2.5.3 : ntp (EulerOS-SA-2019-1222)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical
126847	EulerOS 2.0 SP2 : ntp (EulerOS-SA-2019-1719)	Nessus	Huawei Local Security Checks	2019/7/22	2024/5/9	critical
129259	EulerOS 2.0 SP3 : ntp (EulerOS-SA-2019-2066)	Nessus	Huawei Local Security Checks	2019/9/24	2024/4/23	critical
106497	pfSense < 2.2.5 Multiple Vulnerabilities (SA-15_08)	Nessus	Firewalls	2018/1/31	2018/7/24	high
501783	Rockwell Automation Stratix Network Time Protocol Reference Clock Memory Corruption (CVE-2015-7853)	Tenable OT Security	Tenable.ot	2023/11/15	2024/12/18	critical

检测

插件搜索

critical

high

critical

critical

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

high

critical