Network Time Protocol (NTP) Project NTP daemon (ntpd) is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization.

The remote host is affected by the vulnerability described in GLSA-201509-01 (NTP: Multiple vulnerablities)

    Multiple vulnerabilities have been discovered in NTP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2231 advisory.

    - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
    - allow only one step larger than panic threshold with -g (CVE-2015-5300)
    - validate lengths of values in extension fields (CVE-2014-9297)
    - drop packets with spoofed source address ::1 (CVE-2014-9298)
    - reject packets without MAC when authentication is enabled (CVE-2015-1798)
    - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
    - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses.
(CVE-2014-9298, CVE-2014-9751)

A denial of service flaw was found in the way NTP hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the reached peers. (CVE-2015-1799)

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. (CVE-2015-3405)

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash.
(CVE-2014-9297, CVE-2014-9750)

It was found that ntpd did not check whether a Message Authentication Code (MAC) was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer without the attacker knowing the symmetric key.
(CVE-2015-1798)

The CVE-2015-1798 and CVE-2015-1799 issues were discovered by Miroslav Lichvar of Red Hat.

Bug fixes :

* The ntpd service truncated symmetric keys specified in the key file to 20 bytes. As a consequence, it was impossible to configure NTP authentication to work with peers that use longer keys. With this update, the maximum key length has been changed to 32 bytes.
(BZ#1191111)

* The ntpd service could previously join multicast groups only when starting, which caused problems if ntpd was started during system boot before network was configured. With this update, ntpd attempts to join multicast groups every time network configuration is changed.
(BZ#1207014)

* Previously, the ntp-keygen utility used the exponent of 3 when generating RSA keys. Consequently, generating RSA keys failed when FIPS mode was enabled. With this update, ntp-keygen has been modified to use the exponent of 65537, and generating keys in FIPS mode now works as expected. (BZ#1191116)

* The ntpd service dropped incoming NTP packets if their source port was lower than 123 (the NTP port). With this update, ntpd no longer checks the source port number, and clients behind NAT are now able to correctly synchronize with the server. (BZ#1171640)

Enhancements :

* This update adds support for configurable Differentiated Services Code Points (DSCP) in NTP packets, simplifying configuration in large networks where different NTP implementations or versions are using different DSCP values. (BZ#1202828)

* This update adds the ability to configure separate clock stepping thresholds for each direction (backward and forward). Use the 'stepback' and 'stepfwd' options to configure each threshold.
(BZ#1193154)

* Support for nanosecond resolution has been added to the Structural Health Monitoring (SHM) reference clock. Prior to this update, when a Precision Time Protocol (PTP) hardware clock was used as a time source to synchronize the system clock, the accuracy of the synchronization was limited due to the microsecond resolution of the SHM protocol. The nanosecond extension in the SHM protocol now allows sub-microsecond synchronization of the system clock. (BZ#1117702)

All ntp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

According to its self-reported version, the IOS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information.

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

NTP was updated to fix two security vulnerabilities :

  - ntpd could accept unauthenticated packets with symmetric     key crypto. (CVE-2015-1798)

  - ntpd authentication did not protect symmetric     associations against DoS attacks (CVE-2015-1799)

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p2.
It is, therefore, affected by the following vulnerabilities :

  - The symmetric-key feature in the receive() function     requires a correct message authentication code (MAC)     only if the MAC field has a nonzero length. A     man-in-the-middle attacker can exploit this to spoof     packets by omitting the MAC. (CVE-2015-1798)

  - A flaw exists in the symmetric-key feature in the     receive() function when handling a specially crafted     packet sent to one of two hosts that are peering with     each other. An attacker can exploit this to cause the     next attempt by the servers to synchronize to fail.
    (CVE-2015-1799)

  - A flaw exists in util/ntp-keygen.c due to the way that     the ntp-keygen utility generates MD5 symmetric keys on     big-endian systems. A remote attacker can exploit this     to more easily guess MD5 symmetric keys and thereby     spoof an NTP server or client. (CVE-2015-3405)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - reject packets without MAC when authentication is     enabled (CVE-2015-1798)

  - protect symmetric associations with symmetric key     against DoS attack (CVE-2015-1799)

  - fix generation of MD5 keys with ntp-keygen on big-endian     systems (CVE-2015-3405)

  - log when stepping clock for leap second or ignoring it     with -x (#1204625)

  - fix typos in ntpd man page (#1194463)

  - validate lengths of values in extension fields     (CVE-2014-9297)

  - drop packets with spoofed source address ::1     (CVE-2014-9298)

  - add nanosecond support to SHM refclock (#1117704)

  - allow creating all SHM segments with owner-only access     (#1122015)

  - allow symmetric keys up to 32 bytes again (#1053551)

  - fix calculation of root dispersion (#1045376)

  - fix crash in ntpq mreadvar command (#1165141)

  - don't step clock for leap second with -x option     (#1190619)

  - don't drop packets with source port below 123 (#1171630)

  - use larger RSA exponent in ntp-keygen (#1184421)

  - refresh peers on routing updates (#1193850)

  - increase memlock limit again (#1053568)

  - warn when monitor can't be disabled due to limited     restrict (#1166596)

  - improve documentation of restrict command (#1069019)

  - update logconfig documentation for patched default     (#1193849)

  - don't build ntpsnmpd (#995134)

The remote AIX host has a version of Network Time Protocol (NTP) installed that is affected by a denial of service vulnerability due to a flaw in the symmetric-key feature in the receive() function in file ntp_proto.c when receiving certain invalid packets, which causes state-variable updates to be performed. A man-in-the-middle attacker can exploit this, by spoofing the source IP of a peer, to cause a synchronization loss.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2231 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time     with another referenced time source. These packages include the ntpd     service which continuously adjusts system time and utilities used to query     and configure the ntpd service.

    It was found that because NTP's access control was based on a source IP     address, an attacker could bypass source IP restrictions and send     malicious control and configuration packets by spoofing ::1 addresses.
    (CVE-2014-9298, CVE-2014-9751)

    A denial of service flaw was found in the way NTP hosts that were peering     with each other authenticated themselves before updating their internal     state variables. An attacker could send packets to one peer host, which     could cascade to other peers, and stop the synchronization process among     the reached peers. (CVE-2015-1799)

    A flaw was found in the way the ntp-keygen utility generated MD5 symmetric     keys on big-endian systems. An attacker could possibly use this flaw to     guess generated MD5 keys, which could then be used to spoof an NTP client     or server. (CVE-2015-3405)

    A stack-based buffer overflow was found in the way the NTP autokey protocol     was implemented. When an NTP client decrypted a secret received from an NTP     server, it could cause that client to crash. (CVE-2014-9297, CVE-2014-9750)

    It was found that ntpd did not check whether a Message Authentication Code     (MAC) was present in a received packet when ntpd was configured to use     symmetric cryptographic keys. A man-in-the-middle attacker could use this     flaw to send crafted packets that would be accepted by a client or a peer     without the attacker knowing the symmetric key. (CVE-2015-1798)

    The CVE-2015-1798 and CVE-2015-1799 issues were discovered by Miroslav     Lichvr of Red Hat.

    Bug fixes:

    * The ntpd service truncated symmetric keys specified in the key file to 20     bytes. As a consequence, it was impossible to configure NTP authentication     to work with peers that use longer keys. With this update, the maximum key     length has been changed to 32 bytes. (BZ#1191111)

    * The ntpd service could previously join multicast groups only when     starting, which caused problems if ntpd was started during system boot     before network was configured. With this update, ntpd attempts to join     multicast groups every time network configuration is changed. (BZ#1207014)

    * Previously, the ntp-keygen utility used the exponent of 3 when generating     RSA keys. Consequently, generating RSA keys failed when FIPS mode was     enabled. With this update, ntp-keygen has been modified to use the exponent     of 65537, and generating keys in FIPS mode now works as expected.
    (BZ#1191116)

    * The ntpd service dropped incoming NTP packets if their source port was     lower than 123 (the NTP port). With this update, ntpd no longer checks the     source port number, and clients behind NAT are now able to correctly     synchronize with the server. (BZ#1171640)

    Enhancements:

    * This update adds support for configurable Differentiated Services Code     Points (DSCP) in NTP packets, simplifying configuration in large networks     where different NTP implementations or versions are using different DSCP     values. (BZ#1202828)

    * This update adds the ability to configure separate clock stepping     thresholds for each direction (backward and forward). Use the stepback     and stepfwd options to configure each threshold. (BZ#1193154)

    * Support for nanosecond resolution has been added to the Structural     Health Monitoring (SHM) reference clock. Prior to this update, when a     Precision Time Protocol (PTP) hardware clock was used as a time source to     synchronize the system clock, the accuracy of the synchronization was     limited due to the microsecond resolution of the SHM protocol. The     nanosecond extension in the SHM protocol now allows sub-microsecond     synchronization of the system clock. (BZ#1117702)

    All ntp users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.4. It is, therefore, affected multiple vulnerabilities in the following components :

  - Admin Framework
  - afpserver
  - apache
  - AppleFSCompression
  - AppleGraphicsControl
  - AppleThunderboltEDMService
  - ATS
  - Bluetooth
  - Certificate Trust Policy
  - CFNetwork HTTPAuthentication
  - CoreText
  - coreTLS
  - DiskImages
  - Display Drivers
  - EFI
  - FontParser
  - Graphics Driver
  - ImageIO
  - Install Framework Legacy
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOFireWireFamily
  - Kernel
  - kext tools
  - Mail
  - ntfs
  - ntp
  - OpenSSL
  - QuickTime
  - Security
  - Spotlight
  - SQLite
  - System Stats
  - TrueTypeScaler
  - zip

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85603	AIX 6.1 TL 9 : ntp (IV73783)	Nessus	AIX Local Security Checks	2015/8/25	2023/4/21	medium
85605	AIX 7.1 TL 2 : ntp (IV74262)	Nessus	AIX Local Security Checks	2015/8/25	2023/4/21	medium
86132	GLSA-201509-01 : NTP: Multiple vulnerablities	Nessus	Gentoo Local Security Checks	2015/9/25	2021/1/11	medium
87030	Oracle Linux 7 : ntp (ELSA-2015-2231)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2025/8/29	high
87143	CentOS 7 : ntp (CESA-2015:2231)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	high
108954	Cisco IOS Software Multiple Vulnerabilities in ntpd (cisco-sa-20150408-ntpd)	Nessus	CISCO	2018/4/10	2024/11/11	medium
82921	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : ntp (SSA:2015-111-08)	Nessus	Slackware Local Security Checks	2015/4/22	2021/1/14	medium
83105	openSUSE Security Update : ntp (openSUSE-2015-330)	Nessus	SuSE Local Security Checks	2015/4/28	2021/1/19	medium
83744	Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p2 Multiple Vulnerabilities	Nessus	Misc.	2015/5/21	2019/11/22	high
85143	OracleVM 3.3 : ntp (OVMSA-2015-0102)	Nessus	OracleVM Local Security Checks	2015/7/31	2021/1/4	high
85604	AIX 7.1 TL 3 : ntp (IV74261)	Nessus	AIX Local Security Checks	2015/8/25	2023/4/21	medium
86975	RHEL 7 : ntp (RHSA-2015:2231)	Nessus	Red Hat Local Security Checks	2015/11/20	2025/8/29	high
84488	Mac OS X 10.10.x < 10.10.4 Multiple Vulnerabilities (GHOST) (Logjam)	Nessus	MacOS X Local Security Checks	2015/7/1	2024/5/28	critical

检测

插件搜索

medium

medium

medium

high

high

medium

medium

medium

high

high

medium

high

critical