Bug 1210324 (CVE-2015-3405) - CVE-2015-3405 ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems
Summary: CVE-2015-3405 ntp: ntp-keygen may generate non-random symmetric keys on big-e...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-3405
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1210327 1210554 1221565
Blocks: 1193283 1210268 1210330
TreeView+ depends on / blocked
 
Reported: 2015-04-09 13:13 UTC by Martin Prpič
Modified: 2021-02-17 05:26 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server.
Clone Of:
Environment:
Last Closed: 2019-06-08 02:40:46 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:1459 0 normal SHIPPED_LIVE Moderate: ntp security, bug fix, and enhancement update 2015-07-21 14:15:04 UTC
Red Hat Product Errata RHSA-2015:2231 0 normal SHIPPED_LIVE Moderate: ntp security, bug fix, and enhancement update 2015-11-19 09:03:04 UTC

Description Martin Prpič 2015-04-09 13:13:28 UTC 
A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server.

If the lowest byte of the temp variable is outside of the printable characters range (between 0x20 and 0x7f), the ntp-keygen utility enters an infinite loop. However, if the temp variable is within the aforementioned range, the generated MD5 key will consist of 20 identical characters, meaning only 93 possible keys can be generated.

Upstream bug:

https://bugs.ntp.org/show_bug.cgi?id=2797

Upstream patch:

http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=55199296N2gFqH1Hm5GOnhrk9Ypygg

CVE request:

http://seclists.org/oss-sec/2015/q2/85
Comment 2 Martin Prpič 2015-04-09 13:15:03 UTC 
Created ntp tracking bugs for this issue:

Affects: fedora-all [bug 1210327]
Comment 4 Huzaifa S. Sidhpurwala 2015-04-10 05:04:18 UTC 
Statement:

This issue affects the versions of ntp as shipped with Red Hat Enterprise Linux 5.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Comment 5 Fedora Update System 2015-04-22 22:55:46 UTC 
ntp-4.2.6p5-22.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2015-04-22 22:56:02 UTC 
ntp-4.2.6p5-30.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2015-04-28 13:01:00 UTC 
ntp-4.2.6p5-30.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 errata-xmlrpc 2015-07-22 07:00:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:1459 https://rhn.redhat.com/errata/RHSA-2015-1459.html
Comment 11 errata-xmlrpc 2015-11-19 08:39:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2231 https://rhn.redhat.com/errata/RHSA-2015-2231.html
Note You need to log in before you can comment on or make changes to this bug.