CERT-In Vulnerability Note
CIVN-2014-0288
Multiple Vulnerabilities in Network Time Protocol
Original Issue Date:December 22, 2014
Severity Rating: HIGH
Component Affected
- NTP Service prior to version 4.2.8
Overview
Multiple vulnerabilities have been reported in Network Time Protocol daemon (ntpd) which could be exploited by remote attackers to execute arbitrary code with the privilege of the ntpd process and gain information regarding the integrity checking and authentication encryption schemes.
Description
1. Weak Default Key generation in PRNG
(
CVE-2014-9293
)
The vulnerability exists in "config_auth" function in NTP Daemon that improperly generates a weak default key when no authentication key is defined in the ntp.conf file. A remote attacker could launch attacks like brute force to gain the password in order to exploit this issue.
2. Use of Weak Pseudo-Random Number Generator (PRNG)
(
CVE-2014-9294
)
The vulnerability exists in util/ntp-keygen.c in ntp-keygen which uses a weak Random number generator seed to generate symmetric keys. A remote attacker could exploit this issue by launching brute force attacks to defeat the cryptographic protection schemes.
3. Multiple Stack based Buffer Overflow vulnerabilities
(
CVE-2014-9295
)
The crypto_recv function (when using autokey authentication), ctl_putdata function, and configure function present in NTP Daemon are vulnerable to buffer overflows. An unauthenticated remote attacker could exploit these vulnerabilities by sending crafted packets to trigger buffer overflows.
Further exploitation of this vulnerability could also allow the attacker to execute arbitrary code with the privilege of the ntpd process.
4. Missing return on error
(
CVE-2014-9296
)
The vulnerability exists in a section of code in ntpd which misses a return statement while handling a rare error. Therefore, when the error is encountered, it leads to a nonstop processing.
Solution
Upgrade to NTP version 4.2.8 available at
ntp.org
Vendor Information
Network Time Foundation
http://www.ntp.org
http://support.ntp.org/bin/view/Main/SecurityNotice
References
US CERT
https://ics-cert.us-cert.gov/advisories/ICSA-14-353-01
http://www.kb.cert.org/vuls/id/852879
CVE Name
CVE-2014-9293
CVE-2014-9294
CVE-2014-9295
CVE-2014-9296
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|