As discussed upstream, a flaw was found in the way ntpd processed certain remote configuration packets. Note that remote configuration is disabled by default in NTP. (CVE-2015-5146)

It was found that the :config command can be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-7703)

It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

It was found that ntpd exits with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) is referenced by the statistics or filegen configuration command. (CVE-2015-5195)

It was discovered that sntp would hang in an infinite loop when a crafted NTP packet was received, related to the conversion of the precision value in the packet to double. (CVE-2015-5219)

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. (CVE-2015-3405)

The remote Fedora 23 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-14213 advisory.

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

SNTP processing would enter into an infinite loop when a crafted NTP packet was received. (CVE-2015-5219)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2583 advisory.

    - add disable monitor to default ntp.conf [CVE-2013-5211]
    - don't allow spoofed packet to enable symmetric interleaved mode       (CVE-2016-1548)
    - check mode of new source in config command (CVE-2016-2518)
    - make MAC check resilient against timing attack (CVE-2016-1550)
    - fix crash with invalid logconfig command (CVE-2015-5194)
    - fix crash when referencing disabled statistic type (CVE-2015-5195)
    - don't hang in sntp with crafted reply (CVE-2015-5219)
    - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,       CVE-2015-7702)
    - fix memory leak with autokey (CVE-2015-7701)
    - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
    - don't crash in ntpq with crafted packet (CVE-2015-7852)
    - check key ID in packets authenticated with symmetric key (CVE-2015-7974)
    - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
    - don't allow spoofed packets to demobilize associations (CVE-2015-7979,       CVE-2016-1547)
    - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
    - fix infinite loop in ntpq/ntpdc (CVE-2015-8158)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed :

  - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6     unauthenticated trap information disclosure and DDoS     vector.

  - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay     Prevention DoS.

  - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval     Enforcement DoS.

  - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero     Origin Timestamp Bypass.

  - CVE-2016-7434, bsc#1011398: NULL pointer dereference in
    _IO_str_init_static_internal().

  - CVE-2016-7429, bsc#1011404: Interface selection attack.

  - CVE-2016-7426, bsc#1011406: Client rate limiting and     server responses.

  - CVE-2016-7433, bsc#1011411: Reboot sync calculation     problem.

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).
    Non-security issues fixed :

  - Fix a spurious error message.

  - Other bugfixes, see     /usr/share/doc/packages/ntp/ChangeLog.

  - Fix a regression in 'trap' (bsc#981252).

  - Reduce the number of netlink groups to listen on for     changes to the local network setup (bsc#992606).

  - Fix segfault in 'sntp -a' (bsc#1009434).

  - Silence an OpenSSL version warning (bsc#992038).

  - Make the resolver task change user and group IDs to the     same values as the main task. (bsc#988028)

  - Simplify ntpd's search for its own executable to prevent     AppArmor warnings (bsc#956365).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that when ntp is configured with rate     limiting for all associations the limits are also     applied to responses received from its configured     sources. A remote attacker who knows the sources can     cause a denial of service by preventing ntpd from     accepting valid responses from its     sources.(CVE-2016-7426)

  - ntpq in NTP before 4.2.8p7 allows remote attackers to     obtain origin timestamps and then impersonate peers via     unspecified vectors.(CVE-2015-8139)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to     crash ntpd.(CVE-2015-7977)

  - A vulnerability was found in NTP, in the parsing of     packets from the /dev/datum device. A malicious device     could send crafted messages, causing ntpd to     crash.(CVE-2017-6462)

  - The process_packet function in ntp_proto.c in ntpd in     NTP 4.x before 4.2.8p8 allows remote attackers to cause     a denial of service (peer-variable modification) by     sending spoofed packets from many source IP addresses     in a certain scenario, as demonstrated by triggering an     incorrect leap indication.(CVE-2016-4954)

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.(CVE-2015-5194)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet.(CVE-2015-5219)

  - It was discovered that ntpd as a client did not     correctly check the originate timestamp in received     packets. A remote attacker could use this flaw to send     a crafted packet to an ntpd client that would     effectively disable synchronization with the server, or     push arbitrary offset/delay measurements to modify the     time on the client.(CVE-2015-8138)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7702)

  - Multiple buffer overflow flaws were discovered in     ntpd's crypto_recv(), ctl_putdata(), and configure()     functions. A remote attacker could use either of these     flaws to send a specially crafted request packet that     could crash ntpd or, potentially, execute arbitrary     code with the privileges of the ntp user. Note: the     crypto_recv() flaw requires non default configurations     to be active, while the ctl_putdata() flaw, by default,     can only be exploited via local attackers, and the     configure() flaw requires additional authentication to     exploit.(CVE-2014-9295)

  - It was found that an ntpd client could be forced to     change from basic client/server mode to the interleaved     symmetric mode. A remote attacker could use a spoofed     packet that, when processed by an ntpd client, would     cause that client to reject all future legitimate     server responses, effectively disabling time     synchronization on that client.(CVE-2016-1548)

  - A flaw was found in the way NTP's libntp performed     message authentication. An attacker able to observe the     timing of the comparison function used in packet     authentication could potentially use this flaw to     recover the message digest.(CVE-2016-1550)

  - A denial of service flaw was found in the way NTP     handled preemptable client associations. A remote     attacker could send several crypto NAK packets to a     victim client, each with a spoofed source address of an     existing associated peer, preventing that client from     synchronizing its time.(CVE-2016-1547)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7692)

  - A flaw was found in the way the ntpq client processed     certain incoming packets in a loop in the getresponse()     function. A remote attacker could potentially use this     flaw to crash an ntpq client instance.(CVE-2015-8158)

  - It was discovered that ntpd as a client did not     correctly check timestamps in Kiss-of-Death packets. A     remote attacker could use this flaw to send a crafted     Kiss-of-Death packet to an ntpd client that would     increase the client's polling interval value, and     effectively disable synchronization with the     server.(CVE-2015-7704)

  - A flaw was found in the control mode functionality of     ntpd. A remote attacker could send a crafted control     mode packet which could lead to information disclosure     or result in DDoS amplification attacks.(CVE-2016-9310)

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message.(CVE-2017-6464)

  - It was found that ntpd automatically generated weak     keys for its internal use if no ntpdc request     authentication key was specified in the ntp.conf     configuration file. A remote attacker able to match the     configured IP restrictions could guess the generated     key, and possibly use it to send ntpdc query or     configuration requests.(CVE-2014-9293)

  - A denial of service flaw was found in the way NTP hosts     that were peering with each other authenticated     themselves before updating their internal state     variables. An attacker could send packets to one peer     host, which could cascade to other peers, and stop the     synchronization process among the reached     peers.(CVE-2015-1799)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 21 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-77bfbc1bcd advisory.

    Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691,     CVE-2015-7852, CVE-2015-7701

    ----

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0780 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time     source. These packages include the ntpd service which continuously adjusts system time and utilities used     to query and configure the ntpd service.

    Security Fix(es):

    * It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious     data was not always being completely validated. A remote attacker could use a specially crafted NTP packet     to crash ntpd. (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

    * A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey     authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack,     cause it to run out of memory. (CVE-2015-7701)

    * An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A     specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

    * A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could potentially use this     flaw to crash ntpd. (CVE-2015-7977)

    * A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash     ntpd. (CVE-2015-7978)

    * It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig     configuration commands. (CVE-2015-5194)

    * It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by the statistics or filegen configuration command.
    (CVE-2015-5195)

    * It was discovered that the sntp utility could become unresponsive due to being caught in an infinite     loop when processing a crafted NTP packet. (CVE-2015-5219)

    * It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock     (in hourly intervals). (CVE-2015-7703)

    The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes     and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
85751	Amazon Linux AMI : ntp (ALAS-2015-593)	Nessus	Amazon Linux Local Security Checks	9/3/2015	6/22/2020	high
86027	Fedora 23 : ntp (2015-14213)	Nessus	Fedora Local Security Checks	9/21/2015	8/29/2025	high
88026	F5 Networks BIG-IP : SNTP vulnerability (K60352002)	Nessus	F5 Networks Local Security Checks	1/21/2016	1/4/2019	high
94705	Oracle Linux 7 : ntp (ELSA-2016-2583)	Nessus	Oracle Linux Local Security Checks	11/11/2016	8/29/2025	high
95987	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:3195-1)	Nessus	SuSE Local Security Checks	12/21/2016	1/7/2026	medium
125008	EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1555)	Nessus	Huawei Local Security Checks	5/14/2019	5/22/2024	high
89288	Fedora 21 : ntp (2015-77bfbc1bcd)	Nessus	Fedora Local Security Checks	3/4/2016	8/29/2025	critical
91076	RHEL 6 : ntp (RHSA-2016:0780)	Nessus	Red Hat Local Security Checks	5/12/2016	11/4/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

medium

high

critical

high