Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: decodearr() can write beyond its buffer limit (CVE-2018-7183)

  - ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private     symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of     ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for     CVE-2016-1549. (CVE-2018-7170)

  - The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of     service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through     4.2.8p10. (CVE-2018-7182)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

  - The broadcast mode replay prevention functionality in     ntpd in NTP before 4.2.8p9 allows remote attackers to     cause a denial of service (reject broadcast mode     packets) via a crafted broadcast mode     packet.(CVE-2016-7427)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100     allows remote attackers to cause a denial of service     (daemon exit or system time change) by predicting     transmit timestamps for use in spoofed packets. The     victim must be relying on unauthenticated IPv4 time     sources. There must be an off-path attacker who can     query time from the victim's ntpd     instance.(CVE-2020-13817)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - NTP through 4.2.8p12 has a NULL Pointer     Dereference.(CVE-2019-8936)

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when     configured in broadcast mode, allows man-in-the-middle     attackers to conduct replay attacks by sniffing the     network.(CVE-2015-7973)

  - ntpd in ntp before 4.2.8p3 with remote configuration     enabled allows remote authenticated users with     knowledge of the configuration password and access to a     computer entrusted to perform remote configuration to     cause a denial of service (service crash) via a NULL     byte in a crafted configuration directive     packet.(CVE-2015-5146)

  - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to     execute arbitrary code by leveraging an ntpq query and     sending a response with a crafted array.(CVE-2018-7183)

  - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets     before updating the 'received' timestamp, which allows     remote attackers to cause a denial of service     (disruption) by sending a packet with a zero-origin     timestamp causing the association to reset and setting     the contents of the packet as the most recent     timestamp. This issue is a result of an incomplete fix     for CVE-2015-7704.(CVE-2018-7184)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Symantec Content Analysis running on the   remote host is prior to version 2.3.5.1. It is, therefore,   affected by multiple vulnerabilities:

    - Buffer overflow in the decodearr function in ntpq in     ntp 4.2.8p6 through 4.2.8p10 allows remote attackers     to execute arbitrary code by leveraging an ntpq query     and sending a response with a crafted array.
    (CVE-2018-7183)

    - The ctl_getitem method in ntpd in ntp-4.2.8p6 before       4.2.8p11 allows remote attackers to cause a denial of       service (out-of-bounds read) via a crafted mode 6       packet with a ntpd instance from 4.2.8p6 through       4.2.8p10. (CVE-2018-7182)       
    - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets       before updating the 'received' timestamp, which allows       remote attackers to cause a denial of service       (disruption) by sending a packet with a zero-origin       timestamp causing the association to reset and setting       the contents of the packet as the most recent timestamp.
      (CVE-2018-7184)

An update of the ntp package has been released.

This update for ntp fixes the following issues :

Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3707-1 advisory.

    Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6 packets. A remote attacker     could possibly use this issue to cause ntpd to crash, resulting in a denial of service. This issue only     affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)

    Michael Macnair discovered that NTP incorrectly handled certain responses. A remote attacker could     possibly use this issue to execute arbitrary code. (CVE-2018-7183)

    Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 17.10 and     Ubuntu 18.04 LTS. (CVE-2018-7184)

    Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2018-7185)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ntp fixes the following issues :

  - Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

  - Don't use libevent's cached time stamps in sntp.
    (bsc#1077445) This update is a reissue of the previous     update with LTSS channels included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ntp fixes the following issues :

  - Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

  - Don't use libevent's cached time stamps in sntp.
    (bsc#1077445)

  - Fix systemd migration in %pre (bsc#1034892).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201805-12 (NTP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NTP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Ephemeral association time spoofing additional protection

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549 .(CVE-2018-7170)

Interleaved symmetric mode cannot recover from bad state

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the 'received' timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704 .(CVE-2018-7184)

Ephemeral association time spoofing

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.(CVE-2016-1549)

Buffer read overrun leads information leak in ctl_getitem()

The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. (CVE-2018-7182)

Unauthenticated packet can reset authenticated interleaved association

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the 'other side' of an interleaved association causing the victim ntpd to reset its association.(CVE-2018-7185)

decodearr() can write beyond its buffer limit

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.(CVE-2018-7183)

This update for ntp fixes the following issues :

  - Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

  - Don't use libevent's cached time stamps in sntp.
    (bsc#1077445)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for ntp fixes the following issues :

  - Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

  - Don't use libevent's cached time stamps in sntp.
    (bsc#1077445)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ntp fixes the following issues: Security issues fixed :

  - CVE-2016-1549: Significant additional protections     against CVE-2016-1549 that was fixed in ntp-4.2.8p7     (bsc#1082210).

  - CVE-2018-7170: Ephemeral association time spoofing     additional protection (bsc#1083424).

  - CVE-2018-7182: Buffer read overrun leads information     leak in ctl_getitem() (bsc#1083426).

  - CVE-2018-7183: decodearr() can write beyond its buffer     limit (bsc#1083417).

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state (bsc#1083422).

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association (bsc#1083420). Bug     fixes :

  - bsc#1077445: Don't use libevent's cached time stamps in     sntp.

  - Disable CMAC in ntp when building against a version of     OpenSSL that doesn't support it.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of the remote NTP server is 4.x prior to 4.2.8p11. It is, therefore, affected by multiple vulnerabilities, which allow denial of service attacks, information disclosure and possibly, remote code execution.

Network Time Foundation reports :

The NTP Project at Network Time Foundation is releasing ntp-4.2.8p11.

This release addresses five security issues in ntpd :

- LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack

- INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909 : ctl_getitem():
buffer read overrun leads to undefined behavior and information leak

- LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations

- LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover from bad state

- LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909 : Unauthenticated packet can reset authenticated interleaved association

one security issue in ntpq :

- MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909 : ntpq:decodearr() can write beyond its buffer limit

and provides over 33 bugfixes and 32 other improvements.

ID	Name	Product	Family	Severity
198497	RHEL 8 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196574	RHEL 8 : ntp (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
142303	EulerOS 2.0 SP2 : ntp (EulerOS-SA-2020-2374)	Nessus	Huawei Local Security Checks	critical
135619	EulerOS Virtualization 3.0.2.2 : ntp (EulerOS-SA-2020-1457)	Nessus	Huawei Local Security Checks	critical
134499	EulerOS Virtualization for ARM 64 3.0.2.0 : ntp (EulerOS-SA-2020-1210)	Nessus	Huawei Local Security Checks	critical
130677	EulerOS 2.0 SP5 : ntp (EulerOS-SA-2019-2215)	Nessus	Huawei Local Security Checks	critical
125551	Symantec Content Analysis < 2.3.5.1 affected by Multiple Vulnerabilities (SYMSA1451)	Nessus	Misc.	critical
121863	Photon OS 1.0: Ntp PHSA-2018-1.0-0167	Nessus	PhotonOS Local Security Checks	critical
118269	SUSE SLES12 Security Update : ntp (SUSE-SU-2018:1765-2)	Nessus	SuSE Local Security Checks	critical
110974	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : NTP vulnerabilities (USN-3707-1)	Nessus	Ubuntu Local Security Checks	critical
110639	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:1765-1)	Nessus	SuSE Local Security Checks	critical
110224	SUSE SLES12 Security Update : ntp (SUSE-SU-2018:1464-1)	Nessus	SuSE Local Security Checks	critical
110176	GLSA-201805-12 : NTP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
109697	Amazon Linux AMI : ntp (ALAS-2018-1009)	Nessus	Amazon Linux Local Security Checks	critical
109102	openSUSE Security Update : ntp (openSUSE-2018-376)	Nessus	SuSE Local Security Checks	critical
109085	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:0956-1)	Nessus	SuSE Local Security Checks	critical
108651	SUSE SLES11 Security Update : ntp (SUSE-SU-2018:0808-1)	Nessus	SuSE Local Security Checks	critical
107258	Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p11 Multiple Vulnerabilities	Nessus	Misc.	critical
107046	FreeBSD : ntp -- multiple vulnerabilities (af485ef4-1c58-11e8-8477-d05099c0ae8c)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-7183

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical