针对 CVE-2015-5146、CVE-2015-5194、CVE-2015-5219、CVE-2015-5195、CVE-2015-5196 的安全补丁

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs :

  - CVE-2015-5146     A flaw was found in the way ntpd processed certain     remote configuration packets. An attacker could use a     specially crafted package to cause ntpd to crash if :

    - ntpd enabled remote configuration
    - The attacker had the knowledge of the configuration       password

    - The attacker had access to a computer entrusted to       perform remote configuration

      Note that remote configuration is disabled by default       in NTP.

  - CVE-2015-5194     It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.

  - CVE-2015-5195     It was found that ntpd exits with a segmentation fault     when a statistics type that was not enabled during     compilation (e.g. timingstats) is referenced by the     statistics or filegen configuration command.

  - CVE-2015-5219     It was discovered that sntp program would hang in an     infinite loop when a crafted NTP packet was received,     related to the conversion of the precision value in the     packet to double.

  - CVE-2015-5300     It was found that ntpd did not correctly implement the
    -g option :

  Normally, ntpd exits with a message to the system log if the offset   exceeds the panic threshold, which is 1000 s by default. This option   allows the time to be set to any value without restriction; however,   this can happen only once. If the threshold is exceeded after that,   ntpd will exit with a message to the system log. This option can be   used with the -q and -x options.

  ntpd could actually step the clock multiple times by more than the   panic threshold if its clock discipline doesn't have enough time to   reach the sync state and stay there for at least one update. If a   man-in-the-middle attacker can control the NTP traffic since ntpd   was started (or maybe up to 15-30 minutes after that), they can   prevent the client from reaching the sync state and force it to step   its clock by any amount any number of times, which can be used by   attackers to expire certificates, etc.

  This is contrary to what the documentation says. Normally, the   assumption is that an MITM attacker can step the clock more than the   panic threshold only once when ntpd starts and to make a larger   adjustment the attacker has to divide it into multiple smaller   steps, each taking 15 minutes, which is slow.

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702     It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in ntp_crypto.c, where a packet with particular     autokey operations that contained malicious data was not     always being completely validated. Receipt of these     packets can cause ntpd to crash.

  - CVE-2015-7701     A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd is configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.

  - CVE-2015-7703     Miroslav Lichvar of Red Hat found that the :config     command can be used to set the pidfile and driftfile     paths without any restrictions. A remote attacker could     use this flaw to overwrite a file on the file system     with a file containing the pid of the ntpd process     (immediately) or the current estimated drift of the     system clock (in hourly intervals). For example :

  ntpq -c ':config pidfile /tmp/ntp.pid'ntpq -c ':config driftfile   /tmp/ntp.drift'

  In Debian ntpd is configured to drop root privileges, which limits   the impact of this issue.

  - CVE-2015-7704     If ntpd as an NTP client receives a Kiss-of-Death (KoD)     packet from the server to reduce its polling rate, it     doesn't check if the originate timestamp in the reply     matches the transmit timestamp from its request. An     off-path attacker can send a crafted KoD packet to the     client, which will increase the client's polling     interval to a large value and effectively disable     synchronization with the server.

  - CVE-2015-7850     An exploitable denial of service vulnerability exists in     the remote configuration functionality of the Network     Time Protocol. A specially crafted configuration file     could cause an endless loop resulting in a denial of     service. An attacker could provide a malicious     configuration file to trigger this vulnerability.

  - CVE-2015-7852     A potential off by one vulnerability exists in the     cookedprint functionality of ntpq. A specially crafted     buffer could cause a buffer overflow potentially     resulting in null byte being written out of bounds.

  - CVE-2015-7855     It was found that NTP's decodenetnum() would abort with     an assertion failure when processing a mode 6 or mode 7     packet containing an unusually long data value where a     network address was expected. This could allow an     authenticated attacker to crash ntpd.

  - CVE-2015-7871     An error handling logic error exists within ntpd that     manifests due to improper error condition handling     associated with certain crypto-NAK packets. An     unauthenticated, off-path attacker can force ntpd     processes on targeted servers to peer with time sources     of the attacker's choosing by transmitting symmetric     active crypto-NAK packets to ntpd. This attack bypasses     the authentication typically required to establish a     peer association and allows an attacker to make     arbitrary changes to system time.

The remote Fedora 23 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-14213 advisory.

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 22 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-14212 advisory.

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 21 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-77bfbc1bcd advisory.

    Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691,     CVE-2015-7852, CVE-2015-7701

    ----

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
86331	Fedora 22：ntp-4.2.6p5-33.fc22 (2015-14212)	Nessus	Fedora Local Security Checks	2015/10/12	2025/8/29	high
84590	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : ntp (SSA:2015-188-03)	Nessus	Slackware Local Security Checks	2015/7/8	2021/1/14	medium
86682	Debian DSA-3388-1 : ntp - security update	Nessus	Debian Local Security Checks	2015/11/2	2021/1/11	critical
86027	Fedora 23 : ntp (2015-14213)	Nessus	Fedora Local Security Checks	2015/9/21	2025/8/29	high
86331	Fedora 22 : ntp (2015-14212)	Nessus	Fedora Local Security Checks	2015/10/12	2025/8/29	high
89288	Fedora 21 : ntp (2015-77bfbc1bcd)	Nessus	Fedora Local Security Checks	2016/3/4	2025/8/29	critical

検出

プラグインの検索

high

medium

critical

high

high

critical