Bug 37691 - ntp: Multiple issues (ES 3.1)
Summary: ntp: Multiple issues (ES 3.1)
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: Security updates
Version: UCS 4.0
Hardware: Other Linux
: P3 normal
Target Milestone: UCS 3.1-ES
Assignee: Janek Walkenhorst
QA Contact: Philipp Hahn
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-05 08:47 CET by Moritz Muehlenhoff
Modified: 2015-05-29 15:27 CEST (History)
2 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Customer ID:
Max CVSS v3 score:
requate: Patch_Available+


Attachments
advisory v2 (1.25 KB, text/plain)
2015-05-27 19:11 CEST, Janek Walkenhorst
Details
advisory v3 (1.26 KB, text/plain)
2015-05-28 11:51 CEST, Philipp Hahn
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Moritz Muehlenhoff univentionstaff 2015-02-05 08:47:11 CET
Information leak/denial of service in autokey crypto handling (CVE-2014-9297)
ACLs restricting the access to control mode queries can be bypassed on IPv6 networks(CVE-2014-9298)
Comment 1 Arvid Requate univentionstaff 2015-04-13 14:36:33 CEST
Man-in-the-middle attackers may spoof packets by omitting the MAC because the symmetric-key feature in the receive function in ntp_proto.c requires a correct MAC only if the MAC field has a nonzero length (CVE-2015-1798)

Man-in-the-middle attackers may cause a denial of service (synchronization loss) by spoofing the source IP address of a peer because the symmetric-key feature in the receive function in ntp_proto.c performs state-variable updates upon receiving certain invalid packets (CVE-2015-1799)
Comment 2 Arvid Requate univentionstaff 2015-05-06 16:41:40 CEST
Fixed in upstream Debian package version 1:4.2.6.p2+dfsg-1+deb6u3
Comment 3 Janek Walkenhorst univentionstaff 2015-05-27 19:00:59 CEST
squeeze-lts version built.
Tests (i386, amd64): OK
Comment 4 Janek Walkenhorst univentionstaff 2015-05-27 19:11:53 CEST
Created attachment 6924 [details]
advisory v2
Comment 5 Philipp Hahn univentionstaff 2015-05-28 11:36:29 CEST
Comment on attachment 6924 [details]
advisory v2

A new update is available for Univention Corporate Server 3.1 as
part of the extended security maintenance.
It addresses the following problem:

Program component:  ntp
Reference:          CVE-2014-9297 CVE-2014-9298 CVE-2015-1798 CVE-2015-1799
Fixed version:      1:4.2.6.p2+dfsg-1.41.201505271824

This update fixed the following issues:
- Information leak/denial of service in autokey crypto handling (CVE-2014-9297)
- ACLs restricting the access to control mode queries can be bypassed
  on IPv6 networks(CVE-2014-9298)
- Man-in-the-middle attackers may spoof packets by omitting the MAC because
  the symmetric-key feature in the receive function in ntp_proto.c requires
  a correct MAC only if the MAC field has a nonzero length (CVE-2015-1798)
- Man-in-the-middle attackers may cause a denial of service (synchronization loss)
  by spoofing the source IP address of a peer because the symmetric-key feature
  in the receive function in ntp_proto.c performs state-variable updates upon
  receiving certain invalid packets (CVE-2015-1799)
--
Univention GmbH
be open.
Mary-Somerville-Str.1
28359 Bremen
Tel. : +49 421 22232-0
Fax  : +49 421 22232-99

<info@univention.de>
http://www.univention.de/

Geschäftsführer: Peter H. Ganten
HRB 20755 Amtsgericht Bremen
Steuer-Nr.: 71-597-02876
Comment 6 Philipp Hahn univentionstaff 2015-05-28 11:51:47 CEST
Created attachment 6925 [details]
advisory v3

FIXED: attachment 6924 [details]
 Fixed version:      1:4.2.6.p2+dfsg-1.41.201505271824
 Missing blank
Comment 7 Philipp Hahn univentionstaff 2015-05-28 12:13:50 CEST
OK: apt-get upgrade
OK: /usr/share/doc/ntp/changelog.Debian.gz
FIXED: attachment 6924 [details]
 Fixed version:      1:4.2.6.p2+dfsg-1.41.201505271824
 Geschäftsführer: Peter H. Ganten
OK: ucr set timeserver=1.debian.pool.ntp.org timeserver2=2.debian.pool.ntp.org timeserver3=3.debian.pool.ntp.org
OK: ntpq -p
Comment 8 Janek Walkenhorst univentionstaff 2015-05-29 15:27:54 CEST
Released