ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14415-1 advisory.

  - ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client     from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The     attacker must either be a part of the same broadcast network or control a slave in that broadcast network     that can capture certain required packets on the attacker's behalf and send them to the attacker.
    (CVE-2018-8956)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated     synchronization via a server mode packet with a spoofed source IP address, because transmissions are     rescheduled even when a packet lacks a valid origin timestamp. (CVE-2020-11868)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service     (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The     victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can     query time from the victim's ntpd instance. (CVE-2020-13817)

  - ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of     service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC     key is used and associated with a CMAC algorithm in the ntp.keys file. (CVE-2020-15025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for ntp fixes the following issues :

ntp was updated to 4.2.8p15

  - CVE-2020-11868: Fixed an issue which a server mode     packet with spoofed source address frequently send to     the client ntpd could have caused denial of service     (bsc#1169740).

  - CVE-2018-8956: Fixed an issue which could have allowed     remote attackers to prevent a broadcast client from     synchronizing its clock with a broadcast NTP server via     spoofed mode 3 and mode 5 packets (bsc#1171355).

  - CVE-2020-13817: Fixed an issue which an off-path     attacker with the ability to query time from victim's     ntpd instance could have modified the victim's clock by     a limited amount (bsc#1172651).

  - CVE-2020-15025: Fixed an issue which remote attacker     could have caused denial of service by consuming the     memory when a CMAC key was used andassociated with a     CMAC algorithm in the ntp.keys (bsc#1173334).

  - Removed an OpenSSL version warning (bsc#992038 and     bsc#1125401).

This update was imported from the SUSE:SLE-15:Update update project.

This update for ntp fixes the following issues :

ntp was updated to 4.2.8p15

CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address frequently send to the client ntpd could have caused denial of service (bsc#1169740).

CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed mode 3 and mode 5 packets (bsc#1171355).

CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).

CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
150680	SUSE SLES11 Security Update : ntp (SUSE-SU-2020:14415-1)	Nessus	SuSE Local Security Checks	high
138726	openSUSE Security Update : ntp (openSUSE-2020-934)	Nessus	SuSE Local Security Checks	high
138672	openSUSE Security Update : ntp (openSUSE-2020-1007)	Nessus	SuSE Local Security Checks	high
138311	SUSE SLES12 Security Update : ntp (SUSE-SU-2020:1805-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-8956

medium

Tenable Plugins

high

high

high

high