Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0117.2
ntp panic threshold bypass vulnerability
15 January 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ntp
Publisher: FreeBSD
Operating System: FreeBSD
Impact/Access: Denial of Service -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2015-5300
Reference: ESB-2015.2694
Original Bulletin:
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc
Revision History: January 15 2016: Changed original URL field.
January 15 2016: Initial Release
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
=============================================================================
FreeBSD-SA-16:02.ntp Security Advisory
The FreeBSD Project
Topic: ntp panic threshold bypass vulnerability
Category: contrib
Module: ntp
Announced: 2016-01-14
Credits: Network Time Foundation
Affects: All supported versions of FreeBSD.
Corrected: 2016-01-11 01:09:50 UTC (stable/10, 10.2-STABLE)
2016-01-14 09:10:46 UTC (releng/10.2, 10.2-RELEASE-p9)
2016-01-14 09:11:16 UTC (releng/10.1, 10.1-RELEASE-p26)
2016-01-11 01:48:16 UTC (stable/9, 9.3-STABLE)
2016-01-14 09:11:26 UTC (releng/9.3, 9.3-RELEASE-p33)
CVE Name: CVE-2015-5300
For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.
I. Background
The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP)
used to synchronize the time of a computer system to a reference time
source.
II. Problem Description
The ntpd(8) daemon has a safety feature to prevent excessive stepping of
the clock called the "panic threshold". If ever ntpd(8) determines the
system clock is incorrect by more than this threshold, the daemon exits.
There is an implementation error within the ntpd(8) implementation of this
feature, which allows the system time be adjusted in certain circumstances.
III. Impact
When ntpd(8) is started with the '-g' option specified, the system time will
be corrected regardless of if the time offset exceeds the panic threshold (by
default, 1000 seconds). The FreeBSD rc(8) subsystem allows specifying the
'-g' option by either including '-g' in the ntpd_flags list or by enabling
ntpd_sync_on_start in the system rc.conf(5) file.
If at the moment ntpd(8) is restarted, an attacker can immediately respond to
enough requests from enough sources trusted by the target, which is difficult
and not common, there is a window of opportunity where the attacker can cause
ntpd(8) to set the time to an arbitrary value.
IV. Workaround
No workaround is available, but systems not running ntpd(8), or running
ntpd(8) but do not use ntpd_sync_on_start="YES" or specify the '-g' option in
ntpd_flags are not affected. Neither of these are set by default.
V. Solution
Perform one of the following:
1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.
The ntpd service has to be restarted after the update. A reboot is
recommended but not required.
2) To update your vulnerable system via a binary patch:
Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:
# freebsd-update fetch
# freebsd-update install
The ntpd service has to be restarted after the update. A reboot is
recommended but not required.
3) To update your vulnerable system via a source code patch:
The following patches have been verified to apply to the applicable
FreeBSD release branches.
a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.
[FreeBSD 10.1 and 10.2]
# fetch https://security.FreeBSD.org/patches/SA-16:02/ntp-10.patch
# fetch https://security.FreeBSD.org/patches/SA-16:02/ntp-10.patch.asc
# gpg --verify ntp-10.patch.asc
[FreeBSD 9.3]
# fetch https://security.FreeBSD.org/patches/SA-16:02/ntp-9.patch
# fetch https://security.FreeBSD.org/patches/SA-16:02/ntp-9.patch.asc
# gpg --verify ntp-9.patch.asc
b) Apply the patch. Execute the following commands as root:
# cd /usr/src
# patch < /path/to/patch
c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
Restart the applicable daemons, or reboot the system.
VI. Correction details
The following list contains the correction revision numbers for each
affected branch.
Branch/path Revision
- - -------------------------------------------------------------------------
stable/9/ r293652
releng/9.3/ r293896
stable/10/ r293650
releng/10.1/ r293894
releng/10.2/ r293893
- - -------------------------------------------------------------------------
To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
Or visit the following URL, replacing NNNNNN with the revision number:
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
VII. References
<URL:https://www.cs.bu.edu/~goldbe/NTPattack.html>
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5300>
The latest revision of this advisory is available at
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-16:02.ntp.asc>
- -----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJWl2j2AAoJEO1n7NZdz2rnyg4QAJ/x3xs+pNGXxTT63hbBqLcB
NTSljW5+hFpL94Nr+rHrelvcT3HkvdWUC+7BvMksoUYCZv0vClp5W7tsfuojDPr0
GechK1BpLwxeLnRexulWEuvDQpbr6BN9ABdfSl4h3AaUwGYbBVLMY8aT5JpTiE3I
UZg/5iPXVGFPcfdFhzaPgCpZxQtGI3QV7m5jx+Pf8r0ifuTNi8bAbwHCRzmOV8rA
1LM4fvlCPd6TiP3UANWM7PFGbX8UArgzXlb8jSwkxEVC02oZitol4UhcLgacwVrO
0/0q71pyn8W3NBQ1QPUaUg1M81sE501NCTCP3rEg+o6g7oxiq+GpgB0FKwCJxrTk
n3EL7tyhbvVcsglPLRkIXkGz3o5XdelFJ66+qS+mZAiPozkzEFUIdxd8rHKsA1e4
ZIFARDvDgi8iTArbJnPsQH0CgK8+/2RV2ILFW00Zcu7batvSWJtAUNNFqTSN34tk
JJzHWYwKfGwRIMyEABsy9wLez9K2tRIG0fX75p82dVbRcRZwwSfPmFdfDPuMRRmc
dsNF3133TA92uxwZ177cZk537g+Q0/0I6bts8us3GlCdY2HBuIc+HvRJQyEEqGEv
v1GfEdnwGLp4rmPI8uY+JQ87now7KYhAK1SVil9AXm3tLrIqJsHYayA9nI8mjxfY
Mh1utEeP+TMuievDMQNo
=il8c
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVphjsn6ZAP0PgtI9AQLZQhAArtxThrA9eUCz80ZirLmPg3IBsvC1SZyZ
GX5Rp4RNYsnXUeK13RKZlPcKTCHf5I8NzeGNoqxtYHi1/BPAM87T4NS35SjhpDzR
7qH7Q94Wymzd4HLBW5Hktw7V/lzOJR4g1swxb5NfmP1zkCSlA8OZRKHofGTMzUDA
AMxl+GOUEoG//Qv58oJvHm4x7Xy11LiVUa51ViauaURqNGZbH+cdjrO8YpgjqoSM
1UC8vQgi7sAJojCP7YPcFVAS46uDPzlBi9GoSn3Lg6wJa3WYSjR2C6GAqbWybH/g
9DBCWbAUTGNq+ey8ieFkYTQz7hklZNJVepG9OuNKgxbhJ03gXHZxcYG0Pwej8yLE
qQtCBhu6ok/fBx/eYpPXmOXdewml2Oq9mwJP54cuEUVOuKL5ekHanoQ0HSlPZ6IQ
yBSSona1eoYZhluZ2NtOPz4c6hjRSpxzDDr+SpL7UzKlCDejhW7y7O4oSycZ6GNo
QgSotxWJvY754MvGmDWWz17Z9TfjLZDiohm9z50I6pb5XORNeSqzcbl/Ls75TnaU
//a/9UD3SlPfk86iwJd4EmR+nRU6uq4Z/Mg1DR5vNuPdgbaVzKFVZyk4NGs0GCL4
/VxNCw8liim8mQU2UXZqSjdvDaIzVA01YujYjd1agv9P+PNO+Xt5May8bWLT5CS7
PUCFsWZKUEU=
=5sU4
-----END PGP SIGNATURE-----