CVE-2018-7170

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

This release addresses five security issues in ntpd for Mageia 6:

LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of Cisco.

INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak Reported by Yihan Lian of Qihoo 360.

LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations. Reported on the questions@ list.

LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover from bad state. Reported by Miroslav Lichvar of Red Hat.

LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset authenticated interleaved association. Reported by Miroslav Lichvar of Red Hat.

one security issue in ntpq: MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its buffer limit. Reported by Michael Macnair of Thales-esecurity.com.

and provides over 33 bugfixes and 32 other improvements. ENotification of these issues were delivered to our Institutional members on a rolling basis as they were reported and as progress was made.

These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.

This update for ntp fixes the following issues:

Security issues fixed:

• CVE-2016-1549: Significant additional protections against CVE-2016-1549 that was fixed in ntp-4.2.8p7 (bsc#1082210).
• CVE-2018-7170: Ephemeral association time spoofing additional protection (bsc#1083424).
• CVE-2018-7182: Buffer read overrun leads information leak in ctl_getitem() (bsc#1083426).
• CVE-2018-7183: decodearr() can write beyond its buffer limit (bsc#1083417).
• CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state (bsc#1083422).
• CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association (bsc#1083420).

Bug fixes:

• bsc#1077445: Don't use libevent's cached time stamps in sntp.
• Disable CMAC in ntp when building against a version of OpenSSL that doesn't support it.

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)
• Fix systemd migration in %pre (bsc#1034892).

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

This update for ntp fixes the following issues:

• Update to 4.2.8p11 (bsc#1082210):
  • CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
  • CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
  • CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
  • CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
  • CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
  • CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
• Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

NTP was updated to 4.2.8p12 (bsc#1111853):

• CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
• CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

NTP was updated to 4.2.8p12 (bsc#1111853):

• CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
• CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

NTP was updated to 4.2.8p12 (bsc#1111853):

• CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
• CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

NTP was updated to 4.2.8p12 (bsc#1111853):

• CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
• CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

NTP was updated to 4.2.8p12 (bsc#1111853):

• CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
• CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

NTP was updated to 4.2.8p12 (bsc#1111853):

• CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
• CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.