Scientific Linux Security Update : ntp on SL6.x, SL7.x i386/x86_64 (20141220)

High Nessus Plugin ID 80164

New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.

VPR Score: 6.7

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(), ctl_putdata(), and configure() functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user. Note: the crypto_recv() flaw requires non- default configurations to be active, while the ctl_putdata() flaw, by default, can only be exploited via local attackers, and the configure() flaw requires additional authentication to exploit. (CVE-2014-9295)

It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests. (CVE-2014-9293)

It was found that ntp-keygen used a weak method for generating MD5 keys. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. Note:
it is recommended to regenerate any MD5 keys that had explicitly been generated with ntp-keygen; the default installation does not contain such keys). (CVE-2014-9294)

A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism.
(CVE-2014-9296)

After installing the update, the ntpd daemon will restart automatically.

Solution

Update the affected packages.

See Also

http://www.nessus.org/u?c77e0089

Plugin Details

Severity: High

ID: 80164

File Name: sl_20141220_ntp_on_SL6_x.nasl

Version: 1.13

Type: local

Agent: unix

Published: 2014/12/22

Updated: 2021/01/14

Dependencies: 12634

Risk Information

Risk Factor: High

VPR Score: 6.7

CVSS v2.0

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:fermilab:scientific_linux:ntp, p-cpe:/a:fermilab:scientific_linux:ntp-debuginfo, p-cpe:/a:fermilab:scientific_linux:ntp-doc, p-cpe:/a:fermilab:scientific_linux:ntp-perl, p-cpe:/a:fermilab:scientific_linux:ntpdate, p-cpe:/a:fermilab:scientific_linux:sntp, x-cpe:/o:fermilab:scientific_linux

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/RedHat/release, Host/RedHat/rpm-list

Patch Publication Date: 2014/12/20

Vulnerability Publication Date: 2014/12/20

Reference Information

CVE: CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296