Synopsis:          Moderate: ntp security and bug fix update
Advisory ID:       SLSA-2016:2583-2
Issue Date:        2016-11-03
CVE Numbers:       CVE-2015-5194
                   CVE-2015-5195
                   CVE-2015-7703
                   CVE-2015-5219
                   CVE-2015-7691
                   CVE-2015-7692
                   CVE-2015-7702
                   CVE-2015-7701
                   CVE-2015-7852
                   CVE-2015-7977
                   CVE-2015-7978
                   CVE-2015-7979
                   CVE-2015-7974
                   CVE-2015-8158
--

Security Fix(es):

* It was found that the fix for CVE-2014-9750 was incomplete: three issues
were found in the value length checks in NTP's ntp_crypto.c, where a
packet with particular autokey operations that contained malicious data
was not always being completely validated. A remote attacker could use a
specially crafted NTP packet to crash ntpd. (CVE-2015-7691, CVE-2015-7692,
CVE-2015-7702)

* A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was
configured to use autokey authentication, an attacker could send packets
to ntpd that would, after several days of ongoing attack, cause it to run
out of memory. (CVE-2015-7701)

* An off-by-one flaw, leading to a buffer overflow, was found in
cookedprint functionality of ntpq. A specially crafted NTP packet could
potentially cause ntpq to crash. (CVE-2015-7852)

* A NULL pointer dereference flaw was found in the way ntpd processed
'ntpdc reslist' commands that queried restriction lists with a large
amount of entries. A remote attacker could potentially use this flaw to
crash ntpd. (CVE-2015-7977)

* A stack-based buffer overflow flaw was found in the way ntpd processed
'ntpdc reslist' commands that queried restriction lists with a large
amount of entries. A remote attacker could use this flaw to crash ntpd.
(CVE-2015-7978)

* It was found that when NTP was configured in broadcast mode, a remote
attacker could broadcast packets with bad authentication to all clients.
The clients, upon receiving the malformed packets, would break the
association with the broadcast server, causing them to become out of sync
over a longer period of time. (CVE-2015-7979)

* It was found that ntpd could crash due to an uninitialized variable when
processing malformed logconfig configuration commands. (CVE-2015-5194)

* It was found that ntpd would exit with a segmentation fault when a
statistics type that was not enabled during compilation (e.g. timingstats)
was referenced by the statistics or filegen configuration command.
(CVE-2015-5195)

* It was found that NTP's :config command could be used to set the pidfile
and driftfile paths without any restrictions. A remote attacker could use
this flaw to overwrite a file on the file system with a file containing
the pid of the ntpd process (immediately) or the current estimated drift
of the system clock (in hourly intervals). (CVE-2015-5196, CVE-2015-7703)

* It was discovered that the sntp utility could become unresponsive due to
being caught in an infinite loop when processing a crafted NTP packet.
(CVE-2015-5219)

* A flaw was found in the way NTP verified trusted keys during symmetric
key authentication. An authenticated client (A) could use this flaw to
modify a packet sent between a server (B) and a client (C) using a key
that is different from the one known to the client (A). (CVE-2015-7974)

* A flaw was found in the way the ntpq client processed certain incoming
packets in a loop in the getresponse() function. A remote attacker could
potentially use this flaw to crash an ntpq client instance.
(CVE-2015-8158)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav
Lichvr (Red Hat).

Additional Changes:
--

SL7
  x86_64
    ntp-4.2.6p5-25.el7.x86_64.rpm
    ntp-debuginfo-4.2.6p5-25.el7.x86_64.rpm
    ntpdate-4.2.6p5-25.el7.x86_64.rpm
    sntp-4.2.6p5-25.el7.x86_64.rpm
  noarch
    ntp-doc-4.2.6p5-25.el7.noarch.rpm
    ntp-perl-4.2.6p5-25.el7.noarch.rpm

- Scientific Linux Development Team