Security Advisory. Network Time Protocol Vulnerabilities

Size: px

Start display at page:

Download "Security Advisory. Network Time Protocol Vulnerabilities"

Colleen Gallagher
5 years ago
Views:

1 Security Advisory Network Time Protocol Vulnerabilities Dec 29, 2014

2 TABLE OF CONTENTS GENERAL... 2 CVE Insufficient Entropy in PRNG... 2 CVE Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 2 CVE Stack Buffer Overflow... 2 CVE Error Conditions, Return Values, Status Codes... 3 IMPACT... 3 VULNERABILITY STATUS OR RADWARE PRODUCTS... 3 DOCUMENT HISTORY... 5 General The NTP Project ntpd version and previous versions allow attackers to overflow several buffers in a way that may allow malicious code to be executed. ntp-keygen prior to version 4.2.7p230 also uses a non-cryptographic random number generator when generating symmetric keys. These vulnerabilities affect ntpd acting as a server or client. CVE Insufficient Entropy in PRNG The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. CVE Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. CVE Stack Buffer Overflow Multiple stack-based buffer overflows in ntpd in NTP before allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. Network Time Protocol Vulnerabilities Security Advisory Page 2

3 CVE Error Conditions, Return Values, Status Codes The receive function in ntp_proto.c in ntpd in NTP before continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. Impact The buffer overflow vulnerabilities in ntpd may allow a remote unauthenticated attacker to execute arbitrary malicious code with the privilege level of the ntpd process. The weak default key and non-cryptographic random number generator in ntp-keygen may allow an attacker to gain information regarding the integrity checking and authentication encryption schemes. More specifically, the weak default key allows access to private mode and control mode queries that require authentication, if not restricted by the configuration. Vulnerability Status or Radware Products Product Vulnerability Status Alteon DefensePro AppWall AppDirector CID LinkProof APSolute Vision Alteon is not vulnerable. DefensePro is not vulnerable. AppWall is not vulnerable. AppDirector is not vulnerable. CID is not vulnerable. LinkProof is not vulnerable. APSolute Vision default NTP settings are the recommended values in order to mitigate these vulnerabilities for the NTP versions used by vision. Additionally you can disable NTP, to completely block all use of NTP. In the next APSolute Vision release 3.20 we will upgrade to the latest NTP version that is not vulnerable to these CVEs Network Time Protocol Vulnerabilities Security Advisory Page 3

4 APSolute Vision with APM server Alteon NVG APSolute Vision with APM default NTP settings are the recommended values in order to mitigate these vulnerabilities for the NTP versions used by vision. Additionally you can disable NTP, to completely block all use of NTP. In the next APSolute Vision with APM release 3.20 we will upgrade to the latest NTP version that is not vulnerable to these CVEs Alteon NVG is not vulnerable. Network Time Protocol Vulnerabilities Security Advisory Page 4

5 Document History Document Version Date Issued By Main Changes 1.0 Dec. 25, 2014 Ami Barayev Initial advisory 1.1 Dec. 29, 2014 Ami Barayev Added status on Vision, AppWall, DefensePro and Alteon NVG Network Time Protocol Vulnerabilities Security Advisory Page 5

6 North America Radware Inc. International Radware Ltd. 575 Corporate Drive 22 Raoul Wallenberg St. Mahwah, NJ Tel Aviv 69710, Israel Tel: Tel: Network Time Protocol Vulnerabilities Security Advisory Page 6

7 2014 Radware, Ltd. All Rights Reserved. Radware and all other Radware product and service names are registered trademarks of Radware in the U.S. and other countries. All other trademarks and names are the property of their respective owners. Printed in the U.S.A Network Time Protocol Vulnerabilities Security Advisory Page 7

EMC Test Certificate

EMC Test Certificate 025 K100432.00 1 26 July 2010 Applicant RADWARE Ltd. 22 Raul Wallenberg St., Tel-Aviv, 61131, Israel Tested to FCC Part 15, Sub-part B, Class A Note: Testing was performed between 21 24 September 2009