ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

The remote Ubuntu 20.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5175-1 advisory.

    It was discovered that ntpd incorrectly handled memory when CMAC keys were used. A remote attacker could     possibly use this issue to cause ntpd to crash resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES11 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2020:14415-1 advisory.

  - ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client     from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The     attacker must either be a part of the same broadcast network or control a slave in that broadcast network     that can capture certain required packets on the attacker's behalf and send them to the attacker.
    (CVE-2018-8956)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated     synchronization via a server mode packet with a spoofed source IP address, because transmissions are     rescheduled even when a packet lacks a valid origin timestamp. (CVE-2020-11868)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service     (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The     victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can     query time from the victim's ntpd instance. (CVE-2020-13817)

  - ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of     service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC     key is used and associated with a CMAC algorithm in the ntp.keys file. (CVE-2020-15025)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the ntp package has been released.

According to the versions of the ntp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100     allows remote attackers to cause a denial of service     (daemon exit or system time change) by predicting     transmit timestamps for use in spoofed packets. The     victim must be relying on unauthenticated IPv4 time     sources. There must be an off-path attacker who can     query time from the victim's ntpd     instance.(CVE-2020-13817)

  - ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before     4.3.101 allows remote attackers to cause a denial of     service (memory consumption) by sending packets,     because memory is not freed in situations where a CMAC     key is used and associated with a CMAC algorithm in the     ntp.keys file.(CVE-2020-15025)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ntp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before     4.3.101 allows remote attackers to cause a denial of     service (memory consumption) by sending packets,     because memory is not freed in situations where a CMAC     key is used and associated with a CMAC algorithm in the     ntp.keys file.(CVE-2020-15025)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before     4.3.101 allows remote attackers to cause a denial of     service (memory consumption) by sending packets,     because memory is not freed in situations where a CMAC     key is used and associated with a CMAC algorithm in the     ntp.keys file.(CVE-2020-15025)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202007-12 (NTP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NTP. Please review the       CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

This update for ntp fixes the following issues :

ntp was updated to 4.2.8p15

  - CVE-2020-11868: Fixed an issue which a server mode     packet with spoofed source address frequently send to     the client ntpd could have caused denial of service     (bsc#1169740).

  - CVE-2018-8956: Fixed an issue which could have allowed     remote attackers to prevent a broadcast client from     synchronizing its clock with a broadcast NTP server via     spoofed mode 3 and mode 5 packets (bsc#1171355).

  - CVE-2020-13817: Fixed an issue which an off-path     attacker with the ability to query time from victim's     ntpd instance could have modified the victim's clock by     a limited amount (bsc#1172651).

  - CVE-2020-15025: Fixed an issue which remote attacker     could have caused denial of service by consuming the     memory when a CMAC key was used andassociated with a     CMAC algorithm in the ntp.keys (bsc#1173334).

  - Removed an OpenSSL version warning (bsc#992038 and     bsc#1125401).

This update was imported from the SUSE:SLE-15:Update update project.

The version of the remote NTP server is 4.x prior to 4.2.8p15, or is 4.3.x prior to 4.3.101. It is, therefore, affected by a denial of service vulnerability due to a flaw in handling unauthenticated synchronization traffic. An authenticated attacker can exploit this issue to cause denial of service.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for ntp fixes the following issues :

ntp was updated to 4.2.8p15

CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address frequently send to the client ntpd could have caused denial of service (bsc#1169740).

CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed mode 3 and mode 5 packets (bsc#1171355).

CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651).

CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
183592	Ubuntu 20.04 ESM : NTP vulnerability (USN-5175-1)	Nessus	Ubuntu Local Security Checks	medium
150680	SUSE SLES11 Security Update : ntp (SUSE-SU-2020:14415-1)	Nessus	SuSE Local Security Checks	high
148128	Photon OS 1.0: Ntp PHSA-2021-1.0-0374	Nessus	PhotonOS Local Security Checks	medium
147483	EulerOS Virtualization 2.9.1 : ntp (EulerOS-SA-2021-1616)	Nessus	Huawei Local Security Checks	high
147072	EulerOS Virtualization for ARM 64 3.0.6.0 : ntp (EulerOS-SA-2021-1567)	Nessus	Huawei Local Security Checks	medium
142173	EulerOS 2.0 SP8 : ntp (EulerOS-SA-2020-2314)	Nessus	Huawei Local Security Checks	medium
140116	Photon OS 2.0: Ntp PHSA-2020-2.0-0279	Nessus	PhotonOS Local Security Checks	medium
140112	Photon OS 3.0: Ntp PHSA-2020-3.0-0133	Nessus	PhotonOS Local Security Checks	medium
138935	GLSA-202007-12 : NTP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
138726	openSUSE Security Update : ntp (openSUSE-2020-934)	Nessus	SuSE Local Security Checks	high
138672	openSUSE Security Update : ntp (openSUSE-2020-1007)	Nessus	SuSE Local Security Checks	high
138356	Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p15 / 4.3.x < 4.3.101 DoS	Nessus	Misc.	medium
138311	SUSE SLES12 Security Update : ntp (SUSE-SU-2020:1805-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-15025

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

high

high

high

medium

high