Bug 1274263 (CVE-2015-7854)

Summary: CVE-2015-7854 ntp: password length memory corruption vulnerability
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: jrusnack, mlichvar, sardella
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ntp 4.2.8p4 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-10-23 07:53:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1260670    

Description Martin Prpič 2015-10-22 11:32:09 UTC 
The following flaw was found in ntpd:

A potential buffer overflow vulnerability exists in the password management functionality of ntp. A specially crafted key file could cause a buffer overflow potentially resulting in memory being modified. An attacker could provide a malicious password to trigger this vulnerability.

External References:

http://talosintel.com/reports/TALOS-2015-0065/
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
Comment 1 Martin Prpič 2015-10-23 07:53:27 UTC 
Statement:

This issue did not affect the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7.
Comment 2 Martin Prpič 2015-10-23 09:03:41 UTC 
In version 4.2.6 and earlier of NTP (shipped with RHEL 5, 6, 7), the key size is written in an array rather than dynamically allocated memory (as happens in 4.2.8). The following code handles the size allocation and is not vulnerable to the reported buffer overflow:

sk->keylen = min(len, sizeof(sk->k.MD5_key));
memcpy(sk->k.MD5_key, key, sk->keylen);
Comment 3 Martin Prpič 2015-10-23 09:21:16 UTC 
Upstream patch:

https://github.com/ntp-project/ntp/commit/9c22e66c8f2be6aa0c846f0d9804db20f93c105d