Vulnerability Note VU#374268
NTP Project ntpd reference implementation contains multiple vulnerabilities
Original Release date: 07 Apr 2015 | Last revised: 10 Apr 2015

Overview
NTP Project ntpd reference implementation accepts unauthenticated packets with symmetric key cryptography and does not protect symmetric associations against denial of service attacks.

Description
CVE-2015-1798, bug 2779:
In NTP4 installations utilizing symmetric key authentication, versions ntp-4.2.5p99 to ntp-4.2.8p1, packets with no message authentication code (MAC) are accepted as though they have a valid MAC. An attacker may be able to leverage this validation error to send packets that will be accepted by the client. The CVSS score reflects this issue.

CVE-2015-1799, bug 2781:

In NTP installations utilizing symmetric key authentication, including xntp3.3wy to version ntp-4.2.8p1, a denial of service condition is created when two peering hosts receive packets in which the originate and transmit timestamps do not match. An attacker who periodically sends such packets to both hosts can prevent synchronization.

For more information about these issues, visit NTP’s security notice.

Impact
An unauthenticated attacker with network access may be able to inject packets or prevent peer synchronization among symmetrically authenticated hosts.

Solution
Apply an update

The NTP Project has released version ntp-4.2.8p2 to address these issues.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate UpdatedArista Networks, Inc.Affected-10 Apr 2015
FreeBSD ProjectAffected24 Mar 201510 Apr 2015
NTP ProjectAffected23 Mar 201507 Apr 2015
EfficientIPNot Affected-10 Apr 2015
ACCESSUnknown24 Mar 201524 Mar 2015
Alcatel-LucentUnknown24 Mar 201524 Mar 2015
AppleUnknown24 Mar 201524 Mar 2015
Arch LinuxUnknown30 Mar 201530 Mar 2015
AT&TUnknown24 Mar 201524 Mar 2015
Avaya, Inc.Unknown24 Mar 201524 Mar 2015
Barracuda NetworksUnknown24 Mar 201524 Mar 2015
Belkin, Inc.Unknown24 Mar 201524 Mar 2015
Blue Coat SystemsUnknown24 Mar 201524 Mar 2015
BrocadeUnknown30 Mar 201530 Mar 2015
CA TechnologiesUnknown24 Mar 201524 Mar 2015If you are a vendor and your product is affected, let
us know.View More &raquo

CVSS Metrics (Learn More)

Group
Score
Vector

Base
5.4
AV:A/AC:M/Au:N/C:P/I:P/A:P

Temporal
4.2
E:POC/RL:OF/RC:C

Environmental
4.2
CDP:N/TD:H/CR:ND/IR:ND/AR:ND

References

http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
http://bugs.ntp.org/show_bug.cgi?id=2781
http://bugs.ntp.org/show_bug.cgi?id=2779
http://www.ntp.org/downloads.html

Credit

The NTP Project credits Miroslav Lichvar of Red Hat for reporting these issues.
This document was written by Joel Land.

Other Information

CVE IDs:
CVE-2015-1798
CVE-2015-1799

Date Public:
07 Apr 2015

Date First Published:
07 Apr 2015

Date Last Updated:
10 Apr 2015

Document Revision:
18

FeedbackIf you have feedback, comments, or additional information about this vulnerability, please send us email.

Leave a Reply