SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   ntp Vendors:   ntp.org
(FreeBSD Issues Fix) ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash
SecurityTracker Alert ID:  1038246
SecurityTracker URL:  http://securitytracker.com/id/1038246
CVE Reference:   CVE-2016-9042, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464   (Links to External Site)
Date:  Apr 12 2017
Impact:   Denial of service via local system, Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.2.8p9 and prior
Description:   Multiple vulnerabilities were reported in ntp. A remote or local user can cause the target service to crash.

A remote authenticated user can set a specially crafted configuration directive to cause the target ntpd service to crash [CVE-2017-6464].

A local user that can load a specially crafted '/dev/datum/' device can trigger a buffer overflow in datum_pts_receive() in the legacy Datum Programmable Time Server refclock driver and cause denial of service conditions [CVE-2017-6462].

A remote authenticated user can send a specially crafted ':config' directive to trigger a segmentation fault on the target NTP server [CVE-2017-6463].

A local user can cause DLLs to be executed with elevated privileges and cause denial of service conditions on Windows-based systems [CVE-2017-6455].

A local user can supply specially crafted command line parameters to trigger a stack overflow in addSourceToRegistry() on Windows-based systems [CVE-2017-6452].

A remote user can cause a data structure to be terminated incorrectly on Windows-based systems [CVE-2017-6459].

A remote user can send specially crafted data to trigger an overflow in the ctl_put() function and cause the target service to crash [CVE-2017-6458].

A remote user may be able to trigger an out-of-bounds memory write error in mx4200_send() on systems with the legacy MX4200 refclock enabled and cause the target service to crash [CVE-2017-6451].

A remote ntpd server can trigger a stack buffer overflow in ntpq when return a restriction list to cause the target ntpq service to crash [CVE-2017-6460].

A remote user that can spoof servers can exploit a timestamp origin check flaw and cause timestamp reset replies to be dropped [CVE-2016-9042].

Cure53 and Matthew Van Gundy of Cisco ASIG reported these vulnerabilities.

Impact:   A remote or local user can cause the target service to crash.
Solution:   FreeBSD has issued a fix for CVE-2016-9042, CVE-2017-6462, CVE-2017-6463, and CVE-2017-6464.

The FreeBSD advisory is available at:

https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc

Vendor URL:  security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc (Links to External Site)
Cause:   Access control error, Boundary error, Input validation error, State error
Underlying OS:  UNIX (FreeBSD)
Underlying OS Comments:  10.3, 11.0

Message History:   This archive entry is a follow-up to the message listed below.
Mar 24 2017 ntp Multiple Bugs Let Remote or Local Users Cause the Target Service to Crash



 Source Message Contents

Date:  Wed, 12 Apr 2017 07:23:58 +0000 (UTC)
Subject:  FreeBSD Security Advisory FreeBSD-SA-17:03.ntp

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

=============================================================================
FreeBSD-SA-17:03.ntp                                        Security Advisory
                                                          The FreeBSD Project

Topic:          Multiple vulnerabilities of ntp

Category:       contrib
Module:         ntp
Announced:      2017-04-12
Credits:        Network Time Foundation
Affects:        All supported versions of FreeBSD.
Corrected:      2017-03-28 04:48:17 UTC (stable/11, 11.0-STABLE)
                2017-04-12 06:24:35 UTC (releng/11.0, 11.0-RELEASE-p9)
                2017-03-28 04:48:55 UTC (stable/10, 10.3-STABLE)
                2017-04-12 06:24:35 UTC (releng/10.3, 10.3-RELEASE-p18)
CVE Name:       CVE-2017-6464, CVE-2017-6462, CVE-2017-6463, CVE-2016-9042

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP)
used to synchronize the time of a computer system to a reference time
source.

II.  Problem Description

A vulnerability was discovered in the NTP server's parsing of configuration
directives. [CVE-2017-6464]

A vulnerability was found in NTP, in the parsing of packets from the
DPTS Clock. [CVE-2017-6462]

A vulnerability was discovered in the NTP server's parsing of configuration
directives. [CVE-2017-6463]

A vulnerability was found in NTP, affecting the origin timestamp check
function. [CVE-2016-9042]

III. Impact

A remote, authenticated attacker could cause ntpd to crash by sending a
crafted message. [CVE-2017-6463, CVE-2017-6464]

A malicious device could send crafted messages, causing ntpd to crash.
[CVE-2017-6462]

An attacker able to spoof messages from all of the configured peers
could send crafted packets to ntpd, causing later replies from those
peers to be discarded, resulting in denial of service. [CVE-2016-9042]

IV.  Workaround

No workaround is available, but systems not running ntpd(8) are not
affected.  Network administrators are advised to implement BCP-38,
which helps to reduce the risk associated with these attacks.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

The ntpd service has to be restarted after the update.  A reboot is
recommended but not required.

2) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

The ntpd service has to be restarted after the update.  A reboot is
recommended but not required.

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 11.0]
# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-11.0.patch.xz
# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-11.0.patch.xz.asc
# gpg --verify ntp-11.0.patch.xz.asc

[FreeBSD 10.3]
# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-10.3.patch.xz
# fetch https://security.FreeBSD.org/patches/SA-17:03/ntp-10.3.patch.xz.asc
# gpg --verify ntp-10.3.patch.xz.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart the applicable daemons, or reboot the system.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
- -------------------------------------------------------------------------
stable/10/                                                        r316069
releng/10.3/                                                      r316722
stable/11/                                                        r316068
releng/11.0/                                                      r316722
- -------------------------------------------------------------------------

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:

<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

VII. References

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9042>

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6462>

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6463>

<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6464>

The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:03.ntp.asc>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.19 (FreeBSD)

iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAljty+gACgkQ7Wfs1l3P
audFpxAA30Po/44RV8x98fcopL+/qX0bKhs2yORCcYs/ebrPaDW6ghdqPAPyNDen
qJSoEU6FFZxU508reu6mcJIze0YzSC2D4Xe+BjtVjTUhgZ1mUlfx+0Dqa6DsmyPE
wreYZ0+aPJPSg82P4pOR+Oo4Omh0BHXw/Yu+uJxd+VSGAWg9zJk9QcRyy3QKsPFn
YbMYjAsMk1x2i/q6GzRnoJXAFT9c1QsKRP1QU3JivDEQEYwreqKxkG7Ex9OkUOmL
CIPVG19K7iddnMfiQPjhPhyAOFWrtKMm1rjcg1vSEMUQ24MtVotGOgNkKXEf0vjT
eVX91sIRYGgy9utg6Mg4pnDT7m94PMh7mORgfphHg7l7LFVGYKAbHF7khIMtrs4k
/ZU5i7xZqKR6xNm4oWtaBC9EipkWfjnXjBRG30t3kdD2r7ElJ+Y3mvPdalFsxd+U
gP2Wgn//byToXVUGFLChR7KSWDOjUpdiGu3UUDG4LmG/U4whDsSobPgOF3SzbALF
mx8f7OWkOYCnQ9WuhI3PVvCdLncjZ5UdLaQ5nP53pn3rGk9C4MJpGlTI2iS1gwFV
n09mE5zXueI3jVJm+An2X2Z3C8fTCRHb7n3Sej2wnrgiXk8z/8ftX6VJcUxdgW+A
OYFztl0iKgjgEXix33FZ5baivohQVhAT5rUQRQ/+gcrvL8rbJQg=
=58Te
-----END PGP SIGNATURE-----
_______________________________________________
freebsd-security-notifications@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications
To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribe@freebsd.org"
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, SecurityGlobal.net LLC