CVE-2014-9293

Updated ntp packages fix security vulnerabilities:

If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated (CVE-2014-9293).

ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys (CVE-2014-9294).

A remote unauthenticated attacker may craft special packets that trigger buffer overflows in the ntpd functions crypto_recv() (when using autokey authentication), ctl_putdata(), and configure(). The resulting buffer overflows may be exploited to allow arbitrary malicious code to be executed with the privilege of the ntpd process (CVE-2014-9295).

A section of code in ntpd handling a rare error is missing a return statement, therefore processing did not stop when the error was encountered. This situation may be exploitable by an attacker (CVE-2014-9296).

The ntp package has been patched to fix these issues.

These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ntp provides the following fixes:

* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
  (bnc#887957)
* Fix orphan mode. (bnc#883859)

This collective update for the Network Time Protocol daemon (ntp) provides fixes for the following reports:

* 758253: ntp fails if a host has more than 1024 IP addresses
* 771480: sntp not able to sync against Windows ntp server.

The NTP time service could have been used for remote denial of service amplification attacks.

This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001

http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html

and on

http://support.novell.com/security/cve/CVE-2013-5211.html http://support.novell.com/security/cve/CVE-2013-5211.html

this update now also replaces the default ntp.conf template to fix this problem.

Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described.

Additionally the following bug has been fixed:

* ntp start script does not update /var/lib/ntp/etc/localtime file if
  /etc/localtime is symlink (bnc#838458)

Security Issues:

* CVE-2013-5211
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211>

ntp was updated to fix four security issues.

These security issues were fixed:

• CVE-2014-9294: util/ntp-keygen.c in ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack (bnc#910764 911792).
• CVE-2014-9293: The config_auth function in ntpd, when an auth key was not configured, improperly generated a key, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack (bnc#910764 911792).
• CVE-2014-9298: ::1 can be spoofed on some OSes, so ACLs based on IPv6 ::1 addresses could be bypassed (bnc#911792).
• CVE-2014-9297: Information leak by not properly checking a length in several places in ntp_crypto.c (bnc#911792).

This update for ntp provides the following fixes:

* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
  (bnc#887957)
* Fix orphan mode. (bnc#883859)

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use this issue to brute force the authentication key and send requests if permitted by IP restrictions. (CVE-2014-9293)

Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker could possibly use this issue to brute force the MD5 key and spoof a client or server. (CVE-2014-9294)

Stephen Roettger discovered that NTP contained buffer overflows in the crypto_recv(), ctl_putdata() and configure() functions. In non-default configurations, a remote attacker could use these issues to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. In addition, attackers would be isolated by the NTP AppArmor profile. (CVE-2014-9295)

Stephen Roettger discovered that NTP incorrectly continued processing when handling certain errors. (CVE-2014-9296)