[ntp:security] Fwd: FreeBSD Security Advisory FreeBSD-SA-18:02.ntp

Harlan Stenn harlan at pfcs.com
Wed Mar 7 13:38:04 UTC 2018

Another great (IMO) write-up of our security notice.


-------- Forwarded Message --------
Return-Path: <owner-freebsd-security-notifications at freebsd.org>
X-Original-To: harlan+stenn at imap.pfcs.com
Delivered-To: harlan+stenn at imap.pfcs.com
Received: from localhost (localhost []) by chessie.everett.org
(Postfix) with SMTP id 099D3B847 for <harlan+stenn at imap.pfcs.com>; Wed,
 7 Mar 2018 07:14:41 +0000 (UTC)
Received: from mx2.freebsd.org (mx2.freebsd.org []) (using
TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits)) (No client
certificate requested) by chessie.everett.org (Postfix) with ESMTPS id
87261B843 for <Harlan.Stenn at pfcs.com>; Wed,  7 Mar 2018 07:14:41 +0000 (UTC)
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2610:1c1:1:606c::19:1]) (using TLSv1.2 with cipher
ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN
"mx1.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by
mx2.freebsd.org (Postfix) with ESMTPS id DCBD393C07; Wed,  7 Mar 2018
07:14:40 +0000 (UTC) (envelope-from
owner-freebsd-security-notifications at freebsd.org)
Received: from mailman.ysv.freebsd.org (mailman.ysv.freebsd.org
[IPv6:2001:1900:2254:206a::50:5]) by mx1.freebsd.org (Postfix) with
ESMTP id 277238277C; Wed,  7 Mar 2018 07:14:38 +0000 (UTC)
(envelope-from owner-freebsd-security-notifications at freebsd.org)
Delivered-To: freebsd-security-notifications at mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with
ESMTP id 70B9FF32230 for
<freebsd-security-notifications at mailman.ysv.freebsd.org>; Wed,  7 Mar
2018 07:10:09 +0000 (UTC) (envelope-from security-advisories at freebsd.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
[]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384
(256/256 bits)) (Client CN "freefall.freebsd.org", Issuer "Let's Encrypt
Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id
C2A61820A5; Wed,  7 Mar 2018 07:10:08 +0000 (UTC) (envelope-from
security-advisories at freebsd.org)
Received: by freefall.freebsd.org (Postfix, from userid 945) id
BB2B6447F; Wed,  7 Mar 2018 07:10:08 +0000 (UTC)
From: FreeBSD Security Advisories <security-advisories at freebsd.org>
To: FreeBSD Security Advisories <security-advisories at freebsd.org>
Subject: FreeBSD Security Advisory FreeBSD-SA-18:02.ntp
Precedence: bulk
Message-Id: <20180307071008.BB2B6447F at freefall.freebsd.org>
Date: Wed,  7 Mar 2018 07:10:08 +0000 (UTC)
X-BeenThere: freebsd-security-notifications at freebsd.org
X-Mailman-Version: 2.1.25
List-Id: "Moderated Security Notifications \[moderated, low volume\]"
 <mailto:freebsd-security-notifications-request at freebsd.org?subject=unsubscribe>
List-Post: <mailto:freebsd-security-notifications at freebsd.org>
<mailto:freebsd-security-notifications-request at freebsd.org?subject=help>
 <mailto:freebsd-security-notifications-request at freebsd.org?subject=subscribe>
Reply-To: freebsd-security at freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: owner-freebsd-security-notifications at freebsd.org
Sender: owner-freebsd-security-notifications at freebsd.org
X-DSPAM-Result: Innocent
X-DSPAM-Processed: Wed Mar  7 07:14:41 2018
X-DSPAM-Confidence: 0.9975
X-DSPAM-Improbability: 1 in 40078 chance of being spam
X-DSPAM-Probability: 0.0000
X-DSPAM-Signature: 1900,5a9f916113987486898464

FreeBSD-SA-18:02.ntp                                        Security
                                                          The FreeBSD

Topic:          Multiple vulnerabilities of ntp

Category:       contrib
Module:         ntp
Announced:      2018-03-07
Credits:        Network Time Foundation
Affects:        All supported versions of FreeBSD.
Corrected:      2018-02-28 09:01:03 UTC (stable/11, 11.1-STABLE)
                2018-03-07 05:58:24 UTC (releng/11.1, 11.1-RELEASE-p7)
                2018-03-01 04:06:49 UTC (stable/10, 10.4-STABLE)
                2018-03-07 05:58:24 UTC (releng/10.4, 10.4-RELEASE-p6)
                2018-03-07 05:58:24 UTC (releng/10.3, 10.3-RELEASE-p27)
CVE Name:       CVE-2018-7182, CVE-2018-7170, CVE-2018-7184, CVE-2018-7185,

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit <URL:https://security.FreeBSD.org/>.

I.   Background

The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP)
used to synchronize the time of a computer system to a reference time

II.  Problem Description

The ctl_getitem() function is used by ntpd(8) to process incoming "mode 6"
packets.  A malicious "mode 6" packet can be sent to an ntpd instance, and
if the ntpd instance is from 4.2.8p6 through 4.2.8p10, ctl_getitem() will
read past the end of its buffer. [CVE-2018-7182]

The ntpd(8) service can be vulnerable to Sybil attacks.  If a system is
configured to use a trustedkey and if one is not using the feature
in ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to
which IPs can serve time, a malicious authenticated peer, i.e., one
where the
attacker knows the private symmetric key, can create arbitrarily-many
ephemeral associations in order to win the clock selection of ntpd and
a victim's clock. [CVE-2018-7170]

The fix for NtpBug2952 was incomplete, and while it fixed one problem it
created another.  Specifically, it drops bad packets before updating the
"received" timestamp.  This means a third-party can inject a packet with
a zero-origin timestamp, meaning the sender wants to reset the association,
and the transmit timestamp in this bogus packet will be saved as the most
recent "received" timestamp.  The real remote peer does not know this
value and this will disrupt the association until the association resets.

The NTP Protocol allows for both non-authenticated and authenticated
associations, in client/server, symmetric (peer), and several broadcast
modes.  In addition to the basic NTP operational modes, symmetric mode and
broadcast servers can support an interleaved mode of operation.  In
ntp-4.2.8p4, a bug was inadvertently introduced into the protocol engine
allows a non-authenticated zero-origin (reset) packet to reset an
authenticated interleaved peer association.  If an attacker can send a
with a zero-origin timestamp and the source IP address of the "other
side" of
an interleaved association, the 'victim' ntpd will reset its association.
The attacker must continue sending these packets in order to maintain the
disruption of the association.  [CVE-2018-7185]

The ntpq(8) utility is a monitoring and control program for ntpd.  The
internal decodearr() function of ntpq(8) that is used to decode an array in
a response string when formatted data is being displayed.  This is a problem
in affected versions of ntpq if a maliciously-altered ntpd returns an array
result that will trip this bug, or if a bad actor is able to read an ntpq(8)
request on its way to a remote ntpd server and forge and send a response
before the remote ntpd sends its response.  It is potentially possible that
the malicious data could become injectable/executable code. [CVE-2017-7183]

III. Impact

Malicious remote attackers may be able to break time synchornization,
or cause the ntpq(8) utility to crash.

IV.  Workaround

No workaround is available, but systems not running ntpd(8) or ntpq(8) are
not affected.  Network administrators are advised to implement BCP-38 which
helps to reduce risk associated with the attacks.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to a supported FreeBSD stable or
release / security branch (releng) dated after the correction date.

The ntpd service has to be restarted after the update.  A reboot is
recommended but not required.

2) To update your vulnerable system via a binary patch:

Systems running a RELEASE version of FreeBSD on the i386 or amd64
platforms can be updated via the freebsd-update(8) utility:

# freebsd-update fetch
# freebsd-update install

The ntpd service has to be restarted after the update.  A reboot is
recommended but not required.

3) To update your vulnerable system via a source code patch:

The following patches have been verified to apply to the applicable
FreeBSD release branches.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

[FreeBSD 11.1]
# fetch https://security.FreeBSD.org/patches/SA-18:02/ntp-11.1.patch
# fetch https://security.FreeBSD.org/patches/SA-18:02/ntp-11.1.patch.asc
# gpg --verify ntp-11.1.patch.asc

[FreeBSD 10.4]
# fetch https://security.FreeBSD.org/patches/SA-18:02/ntp-10.4.patch
# fetch https://security.FreeBSD.org/patches/SA-18:02/ntp-10.4.patch.asc
# gpg --verify ntp-10.4.patch.asc

[FreeBSD 10.3]
# fetch https://security.FreeBSD.org/patches/SA-18:02/ntp-10.3.patch
# fetch https://security.FreeBSD.org/patches/SA-18:02/ntp-10.3.patch.asc
# gpg --verify ntp-10.3.patch.asc

b) Apply the patch.  Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch

c) Recompile the operating system using buildworld and installworld as
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

Restart the applicable daemons, or reboot the system.

VI.  Correction details

The following list contains the correction revision numbers for each
affected branch.

Branch/path                                                      Revision
stable/10/                                                        r330141
releng/10.3/                                                      r330567
releng/10.4/                                                      r330567
stable/11/                                                        r330106
releng/11.1/                                                      r330567

To see which files were modified by a particular revision, run the
following command, replacing NNNNNN with the revision number, on a
machine with Subversion installed:

# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

Or visit the following URL, replacing NNNNNN with the revision number:


VII. References







The latest revision of this advisory is available at
freebsd-security-notifications at freebsd.org mailing list
To unsubscribe, send any mail to
"freebsd-security-notifications-unsubscribe at freebsd.org"

More information about the security mailing list