ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution     (CVE-2018-12327)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message.(CVE-2017-6463)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is     enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage)     by sending (1) a spoofed crypto-NAK packet or (2) a     packet with an incorrect MAC value at a certain     time.(CVE-2016-4955)

  - The ntpq and ntpdc command-line utilities that are part     of ntp package are vulnerable to stack-based buffer     overflow via crafted hostname. Applications using these     vulnerable utilities with an untrusted input may be     potentially exploited, resulting in a crash or     arbitrary code execution under privileges of that     application.(CVE-2018-12327)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7     is enabled, allows remote attackers to cause a denial     of service (ntpd abort) by using the same IP address     multiple times in an unconfig directive.(CVE-2016-2516)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client     (A).(CVE-2015-7974)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.(CVE-2015-7701)

  - An out-of-bounds access flaw was found in the way ntpd     processed certain packets. An authenticated attacker     could use a crafted packet to create a peer association     with hmode of 7 and larger, which could potentially     (although highly unlikely) cause ntpd to     crash.(CVE-2016-2518)

  - A stack-based buffer overflow was found in the way the     NTP autokey protocol was implemented. When an NTP     client decrypted a secret received from an NTP server,     it could cause that client to crash.(CVE-2014-9750)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-7703)

  - A flaw was found in the way ntpd running on a host with     multiple network interfaces handled certain server     responses. A remote attacker could use this flaw which     would cause ntpd to not synchronize with the     source.(CVE-2016-7429)

  - A flaw was found in the way ntpd implemented the trap     service. A remote attacker could send a specially     crafted packet to cause a null pointer dereference that     will crash ntpd, resulting in a denial of     service.(CVE-2016-9311)

  - It was found that ntp-keygen used a weak method for     generating MD5 keys. This could possibly allow an     attacker to guess generated MD5 keys that could then be     used to spoof an NTP client or server. Note: it is     recommended to regenerate any MD5 keys that had     explicitly been generated with ntp-keygen the default     installation does not contain such keys.(CVE-2014-9294)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with     bad authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of     time.(CVE-2015-7979)

  - A flaw was found in the way ntpd calculated the root     delay. A remote attacker could send a specially-crafted     spoofed packet to cause denial of service or in some     special cases even crash.(CVE-2016-7433)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7691)

  - It was found that ntpd did not correctly implement the     threshold limitation for the '-g' option, which is used     to set the time without any restrictions. A     man-in-the-middle attacker able to intercept NTP     traffic between a connecting client and an NTP server     could use this flaw to force that client to make     multiple steps larger than the panic threshold,     effectively changing the time to an arbitrary value at     any time.(CVE-2015-5300)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by     the statistics or filegen configuration     command.(CVE-2015-5195)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash.(CVE-2015-7852)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers     to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast     packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548.(CVE-2016-4956)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash     ntpd.(CVE-2015-7978)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.(CVE-2015-5194)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by     the statistics or filegen configuration     command.(CVE-2015-5195)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-5196)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet.(CVE-2015-5219)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7691)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7692)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.(CVE-2015-7701)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7702)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-7703)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash.(CVE-2015-7852)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client     (A).(CVE-2015-7974)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to     crash ntpd.(CVE-2015-7977)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash     ntpd.(CVE-2015-7978)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with     bad authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of     time.(CVE-2015-7979)

  - A flaw was found in the way the ntpq client processed     certain incoming packets in a loop in the getresponse()     function. A remote attacker could potentially use this     flaw to crash an ntpq client instance.(CVE-2015-8158)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2015-5194

The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

CVE-2015-5195 ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

Impact

The ntpd process could stop responding, due to an uninitialized variable, when processing malformed configuration commands.

F5 has evaluated this vulnerability as having low impact to the BIG-IP product line for the following reasons :

This issue is not exposed in a BIG-IP system default configuration.

The configuration that exposes the issue is not recommended by F5.

Security Fix(es) :

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A remote     attacker could use a specially crafted NTP packet to     crash ntpd. (CVE-2015-7691, CVE-2015-7692,     CVE-2015-7702)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory. (CVE-2015-7701)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash. (CVE-2015-7852)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to crash     ntpd. (CVE-2015-7977)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash ntpd.
    (CVE-2015-7978)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with bad     authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of time.
    (CVE-2015-7979)

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands. (CVE-2015-5194)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled during     compilation (e.g. timingstats) was referenced by the     statistics or filegen configuration command.
    (CVE-2015-5195)

  - It was found that NTP's :config command could be used to     set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals). (CVE-2015-5196, CVE-2015-7703)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet. (CVE-2015-5219)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client (A).
    (CVE-2015-7974)

  - A flaw was found in the way the ntpq client processed     certain incoming packets in a loop in the getresponse()     function. A remote attacker could potentially use this     flaw to crash an ntpq client instance. (CVE-2015-8158)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

Additional Changes :

An update for ntp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially crafted NTP packet to crash ntpd.
(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

* A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory. (CVE-2015-7701)

* An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

* A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could potentially use this flaw to crash ntpd. (CVE-2015-7977)

* A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash ntpd. (CVE-2015-7978)

* It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server, causing them to become out of sync over a longer period of time. (CVE-2015-7979)

* It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

* It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) was referenced by the statistics or filegen configuration command. (CVE-2015-5195)

* It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-5196, CVE-2015-7703)

* It was discovered that the sntp utility could become unresponsive due to being caught in an infinite loop when processing a crafted NTP packet. (CVE-2015-5219)

* A flaw was found in the way NTP verified trusted keys during symmetric key authentication. An authenticated client (A) could use this flaw to modify a packet sent between a server (B) and a client (C) using a key that is different from the one known to the client (A). (CVE-2015-7974)

* A flaw was found in the way the ntpq client processed certain incoming packets in a loop in the getresponse() function. A remote attacker could potentially use this flaw to crash an ntpq client instance. (CVE-2015-8158)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvar (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2583 advisory.

    - add disable monitor to default ntp.conf [CVE-2013-5211]
    - don't allow spoofed packet to enable symmetric interleaved mode       (CVE-2016-1548)
    - check mode of new source in config command (CVE-2016-2518)
    - make MAC check resilient against timing attack (CVE-2016-1550)
    - fix crash with invalid logconfig command (CVE-2015-5194)
    - fix crash when referencing disabled statistic type (CVE-2015-5195)
    - don't hang in sntp with crafted reply (CVE-2015-5219)
    - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,       CVE-2015-7702)
    - fix memory leak with autokey (CVE-2015-7701)
    - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
    - don't crash in ntpq with crafted packet (CVE-2015-7852)
    - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
    - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
    - don't allow spoofed packets to demobilize associations (CVE-2015-7979,       CVE-2016-1547)
    - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
    - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2583 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time     source. These packages include the ntpd service which continuously adjusts system time and utilities used     to query and configure the ntpd service.

    Security Fix(es):

    * It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious     data was not always being completely validated. A remote attacker could use a specially crafted NTP packet     to crash ntpd. (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

    * A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey     authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack,     cause it to run out of memory. (CVE-2015-7701)

    * An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A     specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

    * A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could potentially use this     flaw to crash ntpd. (CVE-2015-7977)

    * A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash     ntpd. (CVE-2015-7978)

    * It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets     with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the     association with the broadcast server, causing them to become out of sync over a longer period of time.
    (CVE-2015-7979)

    * It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig     configuration commands. (CVE-2015-5194)

    * It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by the statistics or filegen configuration command.
    (CVE-2015-5195)

    * It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock     (in hourly intervals). (CVE-2015-5196, CVE-2015-7703)

    * It was discovered that the sntp utility could become unresponsive due to being caught in an infinite     loop when processing a crafted NTP packet. (CVE-2015-5219)

    * A flaw was found in the way NTP verified trusted keys during symmetric key authentication. An     authenticated client (A) could use this flaw to modify a packet sent between a server (B) and a client (C)     using a key that is different from the one known to the client (A). (CVE-2015-7974)

    * A flaw was found in the way the ntpq client processed certain incoming packets in a loop in the     getresponse() function. A remote attacker could potentially use this flaw to crash an ntpq client     instance. (CVE-2015-8158)

    The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A remote     attacker could use a specially crafted NTP packet to     crash ntpd. (CVE-2015-7691, CVE-2015-7692,     CVE-2015-7702)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory. (CVE-2015-7701)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash. (CVE-2015-7852)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to crash     ntpd. (CVE-2015-7977)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash ntpd.
    (CVE-2015-7978)

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands. (CVE-2015-5194)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled during     compilation (e.g. timingstats) was referenced by the     statistics or filegen configuration command.
    (CVE-2015-5195)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet. (CVE-2015-5219)

  - It was found that NTP's :config command could be used to     set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals). (CVE-2015-7703)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't allow spoofed packets to demobilize associations     (CVE-2015-7979, CVE-2016-1547)

  - don't allow spoofed packet to enable symmetric     interleaved mode (CVE-2016-1548)

  - check mode of new source in config command     (CVE-2016-2518)

  - make MAC check resilient against timing attack     (CVE-2016-1550)

  - don't accept server/peer packets with zero origin     timestamp (CVE-2015-8138)

  - fix crash with reslist command (CVE-2015-7977,     CVE-2015-7978)

  - fix crash with invalid logconfig command (CVE-2015-5194)

  - fix crash when referencing disabled statistic type     (CVE-2015-5195)

  - don't hang in sntp with crafted reply (CVE-2015-5219)

  - don't crash with crafted autokey packet (CVE-2015-7691,     CVE-2015-7692, CVE-2015-7702)

  - fix memory leak with autokey (CVE-2015-7701)

  - don't allow setting driftfile and pidfile remotely     (CVE-2015-7703)

  - don't crash in ntpq with crafted packet (CVE-2015-7852)

  - add option to set Differentiated Services Code Point     (DSCP) (#1228314)

  - extend rawstats log (#1242895)

  - fix resetting of leap status (#1243034)

  - report clock state changes related to leap seconds     (#1242937)

  - allow -4/-6 on restrict lines with mask (#1232146)

  - retry joining multicast groups (#1288534)

  - explain synchronised state in ntpstat man page     (#1286969)

  - check origin timestamp before accepting KoD RATE packet     (CVE-2015-7704)

  - allow only one step larger than panic threshold with -g     (CVE-2015-5300)

An update for ntp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially crafted NTP packet to crash ntpd.
(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

* A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory. (CVE-2015-7701)

* An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

* A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could potentially use this flaw to crash ntpd. (CVE-2015-7977)

* A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash ntpd. (CVE-2015-7978)

* It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

* It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) was referenced by the statistics or filegen configuration command. (CVE-2015-5195)

* It was discovered that the sntp utility could become unresponsive due to being caught in an infinite loop when processing a crafted NTP packet. (CVE-2015-5219)

* It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-7703)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvar (Red Hat).

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0780 advisory.

    - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
    - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
    - fix crash with invalid logconfig command (CVE-2015-5194)
    - fix crash when referencing disabled statistic type (CVE-2015-5195)
    - don't hang in sntp with crafted reply (CVE-2015-5219)
    - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,       CVE-2015-7702)
    - fix memory leak with autokey (CVE-2015-7701)
    - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
    - don't crash in ntpq with crafted packet (CVE-2015-7852)
    - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0780 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time     source. These packages include the ntpd service which continuously adjusts system time and utilities used     to query and configure the ntpd service.

    Security Fix(es):

    * It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious     data was not always being completely validated. A remote attacker could use a specially crafted NTP packet     to crash ntpd. (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

    * A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey     authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack,     cause it to run out of memory. (CVE-2015-7701)

    * An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A     specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

    * A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could potentially use this     flaw to crash ntpd. (CVE-2015-7977)

    * A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash     ntpd. (CVE-2015-7978)

    * It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig     configuration commands. (CVE-2015-5194)

    * It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by the statistics or filegen configuration command.
    (CVE-2015-5195)

    * It was discovered that the sntp utility could become unresponsive due to being caught in an infinite     loop when processing a crafted NTP packet. (CVE-2015-5219)

    * It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock     (in hourly intervals). (CVE-2015-7703)

    The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes     and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691, CVE-2015-7852, CVE-2015-7701 ---- Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs :

  - CVE-2015-5146     A flaw was found in the way ntpd processed certain     remote configuration packets. An attacker could use a     specially crafted package to cause ntpd to crash if :

    - ntpd enabled remote configuration
    - The attacker had the knowledge of the configuration       password

    - The attacker had access to a computer entrusted to       perform remote configuration

      Note that remote configuration is disabled by default       in NTP.

  - CVE-2015-5194     It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.

  - CVE-2015-5195     It was found that ntpd exits with a segmentation fault     when a statistics type that was not enabled during     compilation (e.g. timingstats) is referenced by the     statistics or filegen configuration command.

  - CVE-2015-5219     It was discovered that sntp program would hang in an     infinite loop when a crafted NTP packet was received,     related to the conversion of the precision value in the     packet to double.

  - CVE-2015-5300     It was found that ntpd did not correctly implement the
    -g option :

  Normally, ntpd exits with a message to the system log if the offset   exceeds the panic threshold, which is 1000 s by default. This option   allows the time to be set to any value without restriction; however,   this can happen only once. If the threshold is exceeded after that,   ntpd will exit with a message to the system log. This option can be   used with the -q and -x options.

  ntpd could actually step the clock multiple times by more than the   panic threshold if its clock discipline doesn't have enough time to   reach the sync state and stay there for at least one update. If a   man-in-the-middle attacker can control the NTP traffic since ntpd   was started (or maybe up to 15-30 minutes after that), they can   prevent the client from reaching the sync state and force it to step   its clock by any amount any number of times, which can be used by   attackers to expire certificates, etc.

  This is contrary to what the documentation says. Normally, the   assumption is that an MITM attacker can step the clock more than the   panic threshold only once when ntpd starts and to make a larger   adjustment the attacker has to divide it into multiple smaller   steps, each taking 15 minutes, which is slow.

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702     It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in ntp_crypto.c, where a packet with particular     autokey operations that contained malicious data was not     always being completely validated. Receipt of these     packets can cause ntpd to crash.

  - CVE-2015-7701     A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd is configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.

  - CVE-2015-7703     Miroslav Lichvar of Red Hat found that the :config     command can be used to set the pidfile and driftfile     paths without any restrictions. A remote attacker could     use this flaw to overwrite a file on the file system     with a file containing the pid of the ntpd process     (immediately) or the current estimated drift of the     system clock (in hourly intervals). For example :

  ntpq -c ':config pidfile /tmp/ntp.pid'ntpq -c ':config driftfile   /tmp/ntp.drift'

  In Debian ntpd is configured to drop root privileges, which limits   the impact of this issue.

  - CVE-2015-7704     If ntpd as an NTP client receives a Kiss-of-Death (KoD)     packet from the server to reduce its polling rate, it     doesn't check if the originate timestamp in the reply     matches the transmit timestamp from its request. An     off-path attacker can send a crafted KoD packet to the     client, which will increase the client's polling     interval to a large value and effectively disable     synchronization with the server.

  - CVE-2015-7850     An exploitable denial of service vulnerability exists in     the remote configuration functionality of the Network     Time Protocol. A specially crafted configuration file     could cause an endless loop resulting in a denial of     service. An attacker could provide a malicious     configuration file to trigger this vulnerability.

  - CVE-2015-7852     A potential off by one vulnerability exists in the     cookedprint functionality of ntpq. A specially crafted     buffer could cause a buffer overflow potentially     resulting in null byte being written out of bounds.

  - CVE-2015-7855     It was found that NTP's decodenetnum() would abort with     an assertion failure when processing a mode 6 or mode 7     packet containing an unusually long data value where a     network address was expected. This could allow an     authenticated attacker to crash ntpd.

  - CVE-2015-7871     An error handling logic error exists within ntpd that     manifests due to improper error condition handling     associated with certain crypto-NAK packets. An     unauthenticated, off-path attacker can force ntpd     processes on targeted servers to peer with time sources     of the attacker's choosing by transmitting symmetric     active crypto-NAK packets to ntpd. This attack bypasses     the authentication typically required to establish a     peer association and allows an attacker to make     arbitrary changes to system time.

Several security issues where found in ntp :

CVE-2015-5146

A flaw was found in the way ntpd processed certain remote configuration packets. An attacker could use a specially crafted package to cause ntpd to crash if :

  - ntpd enabled remote configuration

  - The attacker had the knowledge of the configuration     password

  - The attacker had access to a computer entrusted to     perform remote configuration

    Note that remote configuration is disabled by default in     NTP. 

CVE-2015-5194

It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.

CVE-2015-5195

It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen configuration command

CVE-2015-5219

It was discovered that sntp program would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double.

CVE-2015-5300

It was found that ntpd did not correctly implement the -g option:
Normally, ntpd exits with a message to the system log if the offset exceeds the panic threshold, which is 1000 s by default. This option allows the time to be set to any value without restriction; however, this can happen only once. If the threshold is exceeded after that, ntpd will exit with a message to the system log. This option can be used with the -q and -x options. ntpd could actually step the clock multiple times by more than the panic threshold if its clock discipline doesn't have enough time to reach the sync state and stay there for at least one update. If a man-in-the-middle attacker can control the NTP traffic since ntpd was started (or maybe up to 15-30 minutes after that), they can prevent the client from reaching the sync state and force it to step its clock by any amount any number of times, which can be used by attackers to expire certificates, etc.
This is contrary to what the documentation says. Normally, the assumption is that an MITM attacker can step the clock more than the panic threshold only once when ntpd starts and to make a larger adjustment the attacker has to divide it into multiple smaller steps, each taking 15 minutes, which is slow.

CVE-2015-7691, CVE-2015-7692, CVE-2015-7702

It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. Receipt of these packets can cause ntpd to crash.

CVE-2015-7701

A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory.

CVE-2015-7703

Miroslav Lichv&aacute;r of Red Hat found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals). For example: ntpq -c ':config pidfile /tmp/ntp.pid' ntpq -c ':config driftfile /tmp/ntp.drift' In Debian ntpd is configured to drop root privileges, which limits the impact of this issue.

CVE-2015-7704

When ntpd as an NTP client receives a Kiss-of-Death (KoD) packet from the server to reduce its polling rate, it doesn't check if the originate timestamp in the reply matches the transmit timestamp from its request. An off-path attacker can send a crafted KoD packet to the client, which will increase the client's polling interval to a large value and effectively disable synchronization with the server.

CVE-2015-7850

An exploitable denial of service vulnerability exists in the remote configuration functionality of the Network Time Protocol. A specially crafted configuration file could cause an endless loop resulting in a denial of service. An attacker could provide a the malicious configuration file to trigger this vulnerability.

CVE-2015-7851

A potential path traversal vulnerability exists in the config file saving of ntpd on VMS. A specially crafted path could cause a path traversal potentially resulting in files being overwritten. An attacker could provide a malicious path to trigger this vulnerability.

This issue does not affect Debian.

CVE-2015-7852

A potential off by one vulnerability exists in the cookedprint functionality of ntpq. A specially crafted buffer could cause a buffer overflow potentially resulting in null byte being written out of bounds.

CVE-2015-7855

It was found that NTP's decodenetnum() would abort with an assertion failure when processing a mode 6 or mode 7 packet containing an unusually long data value where a network address was expected. This could allow an authenticated attacker to crash ntpd.

CVE-2015-7871

An error handling logic error exists within ntpd that manifests due to improper error condition handling associated with certain crypto-NAK packets. An unauthenticated, off&shy;-path attacker can force ntpd processes on targeted servers to peer with time sources of the attacker's choosing by transmitting symmetric active crypto&shy;-NAK packets to ntpd. This attack bypasses the authentication typically required to establish a peer association and allows an attacker to make arbitrary changes to system time.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p4.
It is, therefore, affected by the following vulnerabilities :

  - A flaw exists in the ntp_crypto.c file due to improper     validation of the 'vallen' value in extension fields. An     unauthenticated, remote attacker can exploit this, via     specially crafted autokey packets, to disclose     sensitive information or cause a denial of service.
    (CVE-2015-7691)

  - A denial of service vulnerability exists in the autokey     functionality due to a failure in the crypto_bob2(),     crypto_bob3(), and cert_sign() functions to properly     validate the 'vallen' value. An unauthenticated, remote     attacker can exploit this, via specially crafted autokey     packets, to crash the NTP service. (CVE-2015-7692)

  - A denial of service vulnerability exists in the     crypto_recv() function in the file ntp_crypto.c related     to autokey functionality. An unauthenticated, remote     attacker can exploit this, via an ongoing flood of NTPv4     autokey requests, to exhaust memory resources.
    (CVE-2015-7701)

  - A denial of service vulnerability exists due to improper     validation of packets containing certain autokey     operations. An unauthenticated, remote attacker can     exploit this, via specially crafted autokey packets,     to crash the NTP service. (CVE-2015-7702)

  - A flaw exists related to the handling of the 'config:'     command. An authenticated, remote attacker can exploit     this to set the 'pidfile' and 'driftfile' directives     without restrictions, thus allowing the attacker to     overwrite arbitrary files. Note that exploitation of     this issue requires that remote configuration is enabled     for ntpd. (CVE-2015-7703)

  - A denial of service vulnerability exists due improper     validation of the origin timestamp when handling     Kiss-of-Death (KoD) packets. An unauthenticated, remote     attacker can exploit this to stop the client from     querying its servers, preventing it from updating its     clock. (CVE-2015-7704)

  - A denial of service vulnerability exists due to improper     implementation of rate-limiting when handling server     queries. An unauthenticated, remote attacker can exploit     this to stop the client from querying its servers,     preventing it from updating its clock. (CVE-2015-7705)

  - A denial of service vulnerability exists due to an     integer overflow condition in the reset_peer() function     in the file ntp_request.c when handling private mode     packets having request code RESET_PEER (0x16). An     authenticated, remote attacker can exploit this to crash     the NTP service. Note that exploitation of this issue     requires that ntpd is configured to enable mode 7     packets, and that the mode 7 packets are not properly     protected by available authentication and restriction     mechanisms. (CVE-2015-7848)

  - A use-after-free error exists in the auth_delkeys()     function in the file authkeys.c when handling trusted     keys. An authenticated, remote attacker can exploit this     to dereference already freed memory, resulting in a     crash of the NTP service or the execution of arbitrary     code. (CVE-2015-7849)

  - A denial of service vulnerability exists due to a logic     flaw in the authreadkeys() function in the file     authreadkeys.c when handling extended logging where the     log and key files are set to be the same file. An     authenticated, remote attacker can exploit this, via a     crafted set of remote configuration requests, to cause     the NTP service to stop responding. (CVE-2015-7850)

  - A flaw exists in the save_config() function in the file     ntp_control.c due to improper sanitization of     user-supplied input. An authenticated, remote attacker     can exploit this issue, via a crafted set of     configuration requests, to overwrite arbitrary files.
    Note that this issue only affects VMS systems and     requires that ntpd is configured to allow remote     configuration. (CVE-2015-7851)

  - A denial of service vulnerability exists due to an     off-by-one overflow condition in the cookedprint()     function in the file ntpq.c when handling mode 6     response packets. An unauthenticated, remote attacker     can exploit this to crash the NTP service.
    (CVE-2015-7852)

  - A overflow condition exists in the     read_refclock_packet() function in the file ntp_io.c     when handling negative data lengths. A local attacker     can exploit this to crash the NTP service or possibly     gain elevated privileges. (CVE-2015-7853)

  - A heap-based overflow condition exists in function     MD5auth_setkey() in the file authkeys.c when handling     passwords. An authenticated, remote attacker can exploit     this, via a crafted set of configuration requests, to     crash the NTP service or possibly execute arbitrary     code. (CVE-2015-7854)

  - A denial of service vulnerability exists due to an     assertion flaw in the decodenetnum() function in the     file decodenetnum.c when handling long data values in     mode 6 and 7 packets. An unauthenticated, remote     attacker can exploit this to crash the NTP service.
    (CVE-2015-7855)

  - An authentication bypass vulnerability exists in the     receive() function in the file ntp_proto.c when handling     crypto-NAK packets. An unauthenticated, remote attacker     can exploit this to cause the service to accept time     from unauthenticated, ephemeral symmetric peers.
    (CVE-2015-7871)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2783-1 advisory.

    Aleksis Kauppinen discovered that NTP incorrectly handled certain remote config packets. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service. (CVE-2015-5146)

    Miroslav Lichvar discovered that NTP incorrectly handled logconfig directives. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service. (CVE-2015-5194)

    Miroslav Lichvar discovered that NTP incorrectly handled certain statistics types. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service. (CVE-2015-5195)

    Miroslav Lichvar discovered that NTP incorrectly handled certain file paths. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to crash,     resulting in a denial of service, or overwrite certain files. (CVE-2015-5196, CVE-2015-7703)

    Miroslav Lichvar discovered that NTP incorrectly handled certain packets. A remote attacker could possibly     use this issue to cause NTP to hang, resulting in a denial of service. (CVE-2015-5219)

    Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP incorrectly handled restarting     after hitting a panic threshold. A remote attacker could possibly use this issue to alter the system time     on clients. (CVE-2015-5300)

    It was discovered that NTP incorrectly handled autokey data packets. A remote attacker could possibly use     this issue to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

    It was discovered that NTP incorrectly handled memory when processing certain autokey messages. A remote     attacker could possibly use this issue to cause NTP to consume memory, resulting in a denial of service.
    (CVE-2015-7701)

    Aanchal Malhotra, Isaac E. Cohen, and Sharon Goldberg discovered that NTP incorrectly handled rate     limiting. A remote attacker could possibly use this issue to cause clients to stop updating their clock.
    (CVE-2015-7704, CVE-2015-7705)

    Yves Younan discovered that NTP incorrectly handled logfile and keyfile directives. In a non-default     configuration, a remote authenticated attacker could possibly use this issue to cause NTP to enter a loop,     resulting in a denial of service. (CVE-2015-7850)

    Yves Younan and Aleksander Nikolich discovered that NTP incorrectly handled ascii conversion. A remote     attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service, or     possibly execute arbitrary code. (CVE-2015-7852)

    Yves Younan discovered that NTP incorrectly handled reference clock memory. A malicious refclock could     possibly use this issue to cause NTP to crash, resulting in a denial of service, or possibly execute     arbitrary code. (CVE-2015-7853)

    John D Doug Birdwell discovered that NTP incorrectly handled decoding certain bogus values. An attacker     could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2015-7855)

    Stephen Gray discovered that NTP incorrectly handled symmetric association authentication. A remote     attacker could use this issue to possibly bypass authentication and alter the system clock.
    (CVE-2015-7871)

    In the default installation, attackers would be isolated by the NTP AppArmor profile.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

As discussed upstream, a flaw was found in the way ntpd processed certain remote configuration packets. Note that remote configuration is disabled by default in NTP. (CVE-2015-5146)

It was found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-7703)

It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen configuration command. (CVE-2015-5195)

It was discovered that sntp would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double. (CVE-2015-5219)

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. (CVE-2015-3405)

ID	Name	Product	Family	Severity
198530	RHEL 5 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
125009	EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1556)	Nessus	Huawei Local Security Checks	critical
99822	EulerOS 2.0 SP1 : ntp (EulerOS-SA-2016-1060)	Nessus	Huawei Local Security Checks	high
97443	F5 Networks BIG-IP : NTP vulnerabilities (K02360853)	Nessus	F5 Networks Local Security Checks	high
95850	Scientific Linux Security Update : ntp on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	high
95330	CentOS 7 : ntp (CESA-2016:2583)	Nessus	CentOS Local Security Checks	high
94705	Oracle Linux 7 : ntp (ELSA-2016-2583)	Nessus	Oracle Linux Local Security Checks	high
94546	RHEL 7 : ntp (RHSA-2016:2583)	Nessus	Red Hat Local Security Checks	high
91539	Scientific Linux Security Update : ntp on SL6.x i386/x86_64 (20160510)	Nessus	Scientific Linux Local Security Checks	high
91419	OracleVM 3.3 / 3.4 : ntp (OVMSA-2016-0082)	Nessus	OracleVM Local Security Checks	high
91169	CentOS 6 : ntp (CESA-2016:0780)	Nessus	CentOS Local Security Checks	high
91151	Oracle Linux 6 : ntp (ELSA-2016-0780)	Nessus	Oracle Linux Local Security Checks	high
91076	RHEL 6 : ntp (RHSA-2016:0780)	Nessus	Red Hat Local Security Checks	high
89288	Fedora 21 : ntp-4.2.6p5-34.fc21 (2015-77bfbc1bcd)	Nessus	Fedora Local Security Checks	critical
86682	Debian DSA-3388-1 : ntp - security update	Nessus	Debian Local Security Checks	critical
86640	Debian DLA-335-1 : ntp security update	Nessus	Debian Local Security Checks	critical
86631	Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p4 Multiple Vulnerabilities	Nessus	Misc.	critical
86630	Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2783-1)	Nessus	Ubuntu Local Security Checks	critical
86331	Fedora 22 : ntp-4.2.6p5-33.fc22 (2015-14212)	Nessus	Fedora Local Security Checks	high
86027	Fedora 23 : ntp-4.2.6p5-33.fc23 (2015-14213)	Nessus	Fedora Local Security Checks	high
85751	Amazon Linux AMI : ntp (ALAS-2015-593)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2015-5195

high

Tenable Plugins

critical

critical

high

high

high

high

high

high

high

high

high

high

high

critical

critical

critical

critical

critical

high

high

high