SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   ntp Vendors:   ntp.org
(IBM Issues Fix for IBM AIX) ntpd Flaw Lets Remote Users Modify Time on the Target ntp Service in Certain Cases
SecurityTracker Alert ID:  1035073
SecurityTracker URL:  http://securitytracker.com/id/1035073
CVE Reference:   CVE-2015-5300   (Links to External Site)
Date:  Feb 23 2016
Impact:   Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.0 to 4.2.8p5, 4.3.0 to 4.3.78
Description:   A vulnerability was reported in ntp. A remote user that can conduct a man-in-the-middle attack can modify time on the target ntp service.

When ntpd is started with the '-g' option, a remote user that can conduct a man-in-the-middle attack can exploit a threshold limitation flaw to cause the target ntp client to make multiple steps larger than the panic threshold. This can be exploited to set the time to an arbitrary value.

The original advisory is available at:

https://www.cs.bu.edu/~goldbe/NTPattack.html

Aanchal Malhotra, Isaac E. Cohen, Erik Brakke, and Sharon Goldberg of Boston University reported this vulnerability.

Impact:   A remote user that can conduct a man-in-the-middle attack can modify time on the target ntp service.
Solution:   IBM has issued a fix for IBM AIX (APARs IV81129 and IV81130).

The IBM advisory is available at:

https://aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc

Vendor URL:  aix.software.ibm.com/aix/efixes/security/ntp_advisory5.asc (Links to External Site)
Cause:   Access control error
Underlying OS:  UNIX (AIX)
Underlying OS Comments:  6.1, 7.1, 7.2

Message History:   This archive entry is a follow-up to the message listed below.
Jan 14 2016 ntpd Flaw Lets Remote Users Modify Time on the Target ntp Service in Certain Cases



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC