CVE-2018-7182

The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.

This release addresses five security issues in ntpd for Mageia 6:

LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of Cisco.

INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak Reported by Yihan Lian of Qihoo 360.

LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations. Reported on the questions@ list.

LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover from bad state. Reported by Miroslav Lichvar of Red Hat.

LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset authenticated interleaved association. Reported by Miroslav Lichvar of Red Hat.

one security issue in ntpq: MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its buffer limit. Reported by Michael Macnair of Thales-esecurity.com.

and provides over 33 bugfixes and 32 other improvements. ENotification of these issues were delivered to our Institutional members on a rolling basis as they were reported and as progress was made.

These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libntpc1-1.2.1-1.2 package on the GA media of openSUSE Tumbleweed.

This update for ntp fixes the following issues:

Security issues fixed:

• CVE-2016-1549: Significant additional protections against CVE-2016-1549 that was fixed in ntp-4.2.8p7 (bsc#1082210).
• CVE-2018-7170: Ephemeral association time spoofing additional protection (bsc#1083424).
• CVE-2018-7182: Buffer read overrun leads information leak in ctl_getitem() (bsc#1083426).
• CVE-2018-7183: decodearr() can write beyond its buffer limit (bsc#1083417).
• CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state (bsc#1083422).
• CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association (bsc#1083420).

Bug fixes:

• bsc#1077445: Don't use libevent's cached time stamps in sntp.
• Disable CMAC in ntp when building against a version of OpenSSL that doesn't support it.

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)
• Fix systemd migration in %pre (bsc#1034892).

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6 packets. A remote attacker could possibly use this issue to cause ntpd to crash, resulting in a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)

Michael Macnair discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-7183)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu 18.04 LTS. (CVE-2018-7184)

Miroslav Lichvar discovered that NTP incorrectly handled certain zero-origin timestamps. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2018-7185)