Bug 1300266 (CVE-2015-7973)

Summary:	CVE-2015-7973 ntp: replay attack on authenticated broadcast mode
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	mlichvar, sardella, slawomir
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ntp 4.2.8p6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-21 15:23:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1300277
Bug Blocks:	1297474

Description Martin Prpič 2016-01-20 11:41:17 UTC

It was found that when NTP is configured in broadcast mode, a man-in-the-middle attacker or a malicious client could replay packets received from the broadcast server to all (other) clients. This could cause the time on affected clients to become out of sync over a longer period of time.

Upstream patches:

https://github.com/ntp-project/ntp/commit/c801a6a5f84d7f385a42e0073c94b2e0664f8ad2
https://github.com/ntp-project/ntp/commit/50ef2f62dc326bc9edac166b2b4ba5b5d8b4f7d4

Comment 1 Martin Prpič 2016-01-20 11:50:53 UTC

External References:

http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit
http://www.talosintel.com/reports/TALOS-2016-0070/

Comment 2 Martin Prpič 2016-01-20 12:01:43 UTC

Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1300277]

Comment 3 Martin Prpič 2016-01-21 15:23:40 UTC

The issue described here is an inherent problem with securing packet transfer in broadcast mode. The man-in-the-middle attacker also must have access to the same network in which the packets are being broadcasted.

Mitigation:

Do not use NTP's broadcast mode by not configuring the "broadcast" directive in the ntp.conf file.

Comment 4 Martin Prpič 2016-01-21 15:23:57 UTC

Statement:

This issue affects the versions of ntp as shipped with Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue in Red Hat Enterprise Linux 6 and 7. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.