Bug 545990 – net-misc/ntp upgrade to >=4.2.8p2-1: CVE-2015-1798, CVE-2015-1799

• Product: Gentoo Linux
• Status: RESOLVED DUPLICATE

[Description cilly 2015-04-08 18:44:22 UTC]

Pls, add ebuild & mark stable.

Severity: Medium
Date    : 2015-04-08
CVE-ID  : CVE-2015-1798 CVE-2015-1799
Package : ntp
Type    : multiple issues
Remote  : Yes

Description
===========

CVE-2015-1798 (accept unauthenticated packets):

When ntpd is configured to use a symmetric key to authenticate a remote NTP
server/peer, it checks if the NTP message authentication code (MAC) in received
packets is valid, but not if there actually is any MAC included. Packets without
a MAC are accepted as if they had a valid MAC. This allows a MITM attacker to
send false packets that are accepted by the client/peer without having to know
the symmetric key. The attacker needs to know the transmit timestamp of the
client to match it in the forged reply and the false reply needs to reach the
client before the genuine reply from the server. The attacker doesn't
necessarily need to be relaying the packets between the client and the server. 

CVE-2015-1799 (denial of service):

An attacker knowing that NTP hosts A and B are peering with each other
(symmetric association) can send a packet to host A with source address of B
which will set the NTP state variables on A to the values sent by the attacker.
Host A will then send on its next poll to B a packet with originate timestamp
that doesn't match the transmit timestamp of B and the packet will be dropped.
If the attacker does this periodically for both hosts, they won't be able to
synchronize to each other. This is a known denial-of-service attack

Impact
======

CVE-2015-1798 (accept unauthenticated packets):

A MITM attacker could send false packets. These packets could be being accepte
without knowing the symmetric key.

CVE-2015-1799 (denial of service):

An attacker could stop the synchronizing process of ntp. 

References
==========

http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1798
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1799

[Comment 1 Alex Legler (RETIRED) 2015-04-08 19:40:12 UTC]

Pls, take a moment to search for existing bugs before filing a new one.
Pls, also take a moment to review the bug guidelines on where to file your bug.

Thx.

*** This bug has been marked as a duplicate of bug 545836 ***