CVE-2014-9295

Updated ntp packages fix security vulnerabilities:

If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated (CVE-2014-9293).

ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys (CVE-2014-9294).

A remote unauthenticated attacker may craft special packets that trigger buffer overflows in the ntpd functions crypto_recv() (when using autokey authentication), ctl_putdata(), and configure(). The resulting buffer overflows may be exploited to allow arbitrary malicious code to be executed with the privilege of the ntpd process (CVE-2014-9295).

A section of code in ntpd handling a rare error is missing a return statement, therefore processing did not stop when the error was encountered. This situation may be exploitable by an attacker (CVE-2014-9296).

The ntp package has been patched to fix these issues.

These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ntp provides the following fixes:

* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
  (bnc#887957)
* Fix orphan mode. (bnc#883859)

This collective update for the Network Time Protocol daemon (ntp) provides fixes for the following reports:

* 758253: ntp fails if a host has more than 1024 IP addresses
* 771480: sntp not able to sync against Windows ntp server.

The NTP time service could have been used for remote denial of service amplification attacks.

This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001

http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html

and on

http://support.novell.com/security/cve/CVE-2013-5211.html http://support.novell.com/security/cve/CVE-2013-5211.html

this update now also replaces the default ntp.conf template to fix this problem.

Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described.

Additionally the following bug has been fixed:

* ntp start script does not update /var/lib/ntp/etc/localtime file if
  /etc/localtime is symlink (bnc#838458)

Security Issues:

* CVE-2013-5211
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211>

This update for ntp provides the following fixes:

* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
  (bnc#887957)
* Fix orphan mode. (bnc#883859)

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use this issue to brute force the authentication key and send requests if permitted by IP restrictions. (CVE-2014-9293)

Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker could possibly use this issue to brute force the MD5 key and spoof a client or server. (CVE-2014-9294)

Stephen Roettger discovered that NTP contained buffer overflows in the crypto_recv(), ctl_putdata() and configure() functions. In non-default configurations, a remote attacker could use these issues to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. In addition, attackers would be isolated by the NTP AppArmor profile. (CVE-2014-9295)

Stephen Roettger discovered that NTP incorrectly continued processing when handling certain errors. (CVE-2014-9296)