Bugzilla – Bug 962994
VUL-0: CVE-2015-8140: ntp,xntp: ntpq protocol vulnerable to replay attacks
Last modified: 2016-05-18 11:20:18 UTC
http://support.ntp.org/bin/view/Main/NtpBug2947 Summary: The ntpq protocol is vulnerable to replay attacks. The sequence number being included under the signature fails to prevent replay attacks for two reasons. Commands that don't require authentication can be used to move the sequence number forward, and NTP doesn't actually care what sequence number is used so a packet can be replayed at any time. If, for example, an attacker can intercept authenticated reconfiguration commands that would. for example, tell ntpd to connect with a server that turns out to be malicious and a subsequent reconfiguration directive removed that malicious server, the attacker could replay the configuration command to re-establish an association to malicious server. Yes, this is an unlikely scenario, but it could still happen. References: https://bugzilla.redhat.com/show_bug.cgi?id=1300651 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8140 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8140
Upstream decided to rely on mitigations only: - Configure ntpd to get time from multiple sources. - Use restrict statments in your ntp.conf file to limit who is allowed to issue ntpq queries and remote configuration commands. - Monitor your ntpd instances.
SUSE-SU-2016:1175-1: An update that solves 12 vulnerabilities and has 8 fixes is now available. Category: security (important) Bug References: 782060,784760,916617,951559,951629,956773,962318,962784,962802,962960,962966,962970,962988,962994,962995,962997,963000,963002,975496,975981 CVE References: CVE-2015-5300,CVE-2015-7973,CVE-2015-7974,CVE-2015-7975,CVE-2015-7976,CVE-2015-7977,CVE-2015-7978,CVE-2015-7979,CVE-2015-8138,CVE-2015-8139,CVE-2015-8140,CVE-2015-8158 Sources used: SUSE Linux Enterprise Server 11-SP4 (src): ntp-4.2.8p6-8.2 SUSE Linux Enterprise Debuginfo 11-SP4 (src): ntp-4.2.8p6-8.2
SUSE-SU-2016:1177-1: An update that solves 12 vulnerabilities and has 8 fixes is now available. Category: security (important) Bug References: 782060,916617,937837,951559,951629,956773,962318,962784,962802,962960,962966,962970,962988,962994,962995,962997,963000,963002,975496,975981 CVE References: CVE-2015-5300,CVE-2015-7973,CVE-2015-7974,CVE-2015-7975,CVE-2015-7976,CVE-2015-7977,CVE-2015-7978,CVE-2015-7979,CVE-2015-8138,CVE-2015-8139,CVE-2015-8140,CVE-2015-8158 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP1 (src): yast2-ntp-client-3.1.22-6.2 SUSE Linux Enterprise Server 12-SP1 (src): ntp-4.2.8p6-8.2, yast2-ntp-client-3.1.22-6.2 SUSE Linux Enterprise Desktop 12-SP1 (src): ntp-4.2.8p6-8.2, yast2-ntp-client-3.1.22-6.2
SUSE-SU-2016:1247-1: An update that solves 28 vulnerabilities and has two fixes is now available. Category: security (important) Bug References: 782060,905885,910063,916617,920238,926510,936327,937837,942587,944300,946386,951559,951608,951629,954982,956773,962318,962784,962802,962960,962966,962970,962988,962994,962995,962997,963000,963002,975496,975981 CVE References: CVE-2015-5300,CVE-2015-7691,CVE-2015-7692,CVE-2015-7701,CVE-2015-7702,CVE-2015-7703,CVE-2015-7704,CVE-2015-7705,CVE-2015-7848,CVE-2015-7849,CVE-2015-7850,CVE-2015-7851,CVE-2015-7852,CVE-2015-7853,CVE-2015-7854,CVE-2015-7855,CVE-2015-7871,CVE-2015-7973,CVE-2015-7974,CVE-2015-7975,CVE-2015-7976,CVE-2015-7977,CVE-2015-7978,CVE-2015-7979,CVE-2015-8138,CVE-2015-8139,CVE-2015-8140,CVE-2015-8158 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): yast2-ntp-client-3.1.12.4-8.2 SUSE Linux Enterprise Server 12 (src): ntp-4.2.8p6-46.5.2, yast2-ntp-client-3.1.12.4-8.2 SUSE Linux Enterprise Desktop 12 (src): ntp-4.2.8p6-46.5.2, yast2-ntp-client-3.1.12.4-8.2
openSUSE-SU-2016:1292-1: An update that solves 12 vulnerabilities and has 8 fixes is now available. Category: security (important) Bug References: 782060,916617,937837,951559,951629,956773,962318,962784,962802,962960,962966,962970,962988,962994,962995,962997,963000,963002,975496,975981 CVE References: CVE-2015-5300,CVE-2015-7973,CVE-2015-7974,CVE-2015-7975,CVE-2015-7976,CVE-2015-7977,CVE-2015-7978,CVE-2015-7979,CVE-2015-8138,CVE-2015-8139,CVE-2015-8140,CVE-2015-8158 Sources used: openSUSE Leap 42.1 (src): ntp-4.2.8p6-15.1, yast2-ntp-client-3.1.22-6.1
SUSE-SU-2016:1311-1: An update that solves 30 vulnerabilities and has 6 fixes is now available. Category: security (important) Bug References: 782060,784760,905885,910063,916617,920183,920238,926510,936327,937837,942441,942587,943216,943218,944300,946386,951351,951559,951608,951629,954982,956773,962318,962784,962802,962960,962966,962970,962988,962994,962995,962997,963000,963002,975496,975981 CVE References: CVE-2015-5194,CVE-2015-5219,CVE-2015-5300,CVE-2015-7691,CVE-2015-7692,CVE-2015-7701,CVE-2015-7702,CVE-2015-7703,CVE-2015-7704,CVE-2015-7705,CVE-2015-7848,CVE-2015-7849,CVE-2015-7850,CVE-2015-7851,CVE-2015-7852,CVE-2015-7853,CVE-2015-7854,CVE-2015-7855,CVE-2015-7871,CVE-2015-7973,CVE-2015-7974,CVE-2015-7975,CVE-2015-7976,CVE-2015-7977,CVE-2015-7978,CVE-2015-7979,CVE-2015-8138,CVE-2015-8139,CVE-2015-8140,CVE-2015-8158 Sources used: SUSE OpenStack Cloud 5 (src): ntp-4.2.8p6-41.1 SUSE Manager Proxy 2.1 (src): ntp-4.2.8p6-41.1 SUSE Manager 2.1 (src): ntp-4.2.8p6-41.1 SUSE Linux Enterprise Server 11-SP3-LTSS (src): ntp-4.2.8p6-41.1 SUSE Linux Enterprise Server 11-SP2-LTSS (src): ntp-4.2.8p6-41.1, yast2-ntp-client-2.17.14.1-1.12.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): ntp-4.2.8p6-41.1 SUSE Linux Enterprise Debuginfo 11-SP2 (src): ntp-4.2.8p6-41.1