Security Update for ntp Package
Summary
DSA-3388-1: ntp - security update. Affects ntp versions < 1:4.2.6.p5+dfsg-2+deb7u6. Fixed in 1:4.2.6.p5+dfsg-2+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ntp package is a Network Time Protocol daemon and utility program used for time synchronization on computer systems. It enables computers to maintain accurate time by synchronizing with NTP servers. This package is vulnerable to several security issues that could be exploited by attackers to cause denial of service, crash the daemon, or manipulate system time.
Vulnerability Detail
The vulnerabilities in the ntp package include:
- CVE-2015-5146: A flaw in ntpd's processing of remote configuration packets could allow an attacker with knowledge of the configuration password to crash the daemon.
- CVE-2015-5194: ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
- CVE-2015-5195: ntpd exits with a segmentation fault when referencing a statistics type not enabled during compilation.
- CVE-2015-5219: The sntp program hangs in an infinite loop when receiving a crafted NTP packet, leading to a denial of service.
- CVE-2015-5300: ntpd does not correctly implement the -g option, allowing an attacker to step the clock multiple times by more than the panic threshold.
- CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete fix for a previous vulnerability, allowing malicious data to crash ntpd.
- CVE-2015-7701: A memory leak flaw in ntpd's CRYPTO_ASSOC could be exploited to exhaust memory.
- CVE-2015-7703: The :config command allows overwriting files on the file system.
- CVE-2015-7704: ntpd as an NTP client can be disabled by a crafted Kiss-of-Death packet.
- CVE-2015-7850: A specially crafted configuration file can cause an endless loop and denial of service.
- CVE-2015-7852: A potential buffer overflow in ntpq's cookedprint functionality.
- CVE-2015-7855: An authenticated attacker can crash ntpd by sending an unusually long data value in mode 6 or mode 7 packets.
- CVE-2015-7871: Improper error handling allows an off-path attacker to force ntpd processes to peer with time sources of their choosing, bypassing authentication.
How To Fix
Minimum fixed version
1:4.2.6.p5+dfsg-2+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ntpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
The ntp package is affected by multiple vulnerabilities that could lead to denial of service, system crashes, or manipulation of system time. It is crucial to update the package to the fixed versions mentioned above to mitigate these risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ntp →
FAQ
These vulnerabilities could allow attackers to crash the ntp daemon, manipulate system time, cause denial of service, or overwrite files on the file system.
No, remote configuration is disabled by default in NTP.
Yes, if the attacker can control the NTP traffic since ntpd was started or up to 15-30 minutes after that, they can prevent the client from reaching the sync state and force it to step its clock multiple times.
The -g option allows the time to be set to any value without restriction. However, it can only be used once, and if the offset exceeds the panic threshold after that, ntpd will exit with a message to the system log.
An attacker can force ntpd processes on targeted servers to peer with time sources of their choosing by transmitting symmetric active crypto-NAK packets. This bypasses the authentication typically required to establish a peer association and allows arbitrary changes to system time.
Related vulnerabilities
Recent vulnerabilities recorded for ntp.
