Share: Email | Twitter

ID

VDE-2022-032

Published

2022-08-09 10:00 (CEST)

Last update

2022-08-09 10:01 (CEST)

Vendor(s)

AUMA Riester GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
- SIMA² Master Station < V 2.6

Summary

The SIMA2 Master Station features an NTP service based on ntpd, a reference implementation of the Network Time Protocol (NTP). Affected SIMA2 Master Stations with software version < V2.6 include an outdated version of ntpd which is affected by a large number of vulnerabilities

Vulnerabilities



Weakness
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
Summary

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) ...

Weakness
Improper Input Validation (CWE-20)
Summary

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

Weakness
Out-of-bounds Write (CWE-787)
Summary

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument ...

Weakness
Improper Authentication (CWE-287)
Summary

Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.

Weakness
Out-of-bounds Write (CWE-787)
Summary

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with ...

Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.

Weakness
Use After Free (CWE-416)
Summary

Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via ...

Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a ...

Weakness
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
Summary

Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly ...

Weakness
Out-of-bounds Write (CWE-787)
Summary

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local ...

Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted ...

Weakness
Improper Authentication (CWE-287)
Summary

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an ...

Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source ...

Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with ...

Weakness
Out-of-bounds Read (CWE-125)
Summary

The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance ...

Weakness
Summary

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic ...

Weakness
Summary

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey ...

Weakness
Origin Validation Error (CWE-346)
Summary

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions ...

Weakness
NULL Pointer Dereference (CWE-476)
Summary

NTP through 4.2.8p12 has a NULL Pointer Dereference.

Weakness
7PK - Time and State (CWE-361)
Summary

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers ...

Weakness
Improper Input Validation (CWE-20)
Summary

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey ...

Weakness
Improper Input Validation (CWE-20)
Summary

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to ...

Weakness
Missing Release of Resource after Effective Lifetime (CWE-772)
Summary

Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).

Weakness
Improper Input Validation (CWE-20)
Summary

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address ...

Weakness
Improper Input Validation (CWE-20)
Summary

The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.

Weakness
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Summary

The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source ...

Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the ...

Weakness
Data Processing Errors (CWE-19)
Summary

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast ...

Weakness
Improper Input Validation (CWE-20)
Summary

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.

Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent ...

Weakness
NULL Pointer Dereference (CWE-476)
Summary

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for ...

Weakness
Improper Authentication (CWE-287)
Summary

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain ...

Weakness
Use of Insufficiently Random Values (CWE-330)
Summary

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use ...

Weakness
Data Processing Errors (CWE-19)
Summary

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client ...

Weakness
Data Processing Errors (CWE-19)
Summary

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and ...

Weakness
7PK - Security Features (CWE-254)
Summary

NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.

Weakness
Improper Input Validation (CWE-20)
Summary

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to ...

Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.

Weakness
Improper Input Validation (CWE-20)
Summary

The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode ...

Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.

Weakness
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation ...

Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the ...

Weakness
Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
Summary

ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at ...

Weakness
Summary

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) ...

Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service ...

Weakness
Improper Input Validation (CWE-20)
Summary

ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.

Weakness
NULL Pointer Dereference (CWE-476)
Summary

ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.

Weakness
NULL Pointer Dereference (CWE-476)
Summary

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem ...

Weakness
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Summary

ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK ...

Weakness
Summary

The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect ...

Weakness
Improper Input Validation (CWE-20)
Summary

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon ...

Weakness
Improper Input Validation (CWE-20)
Summary

An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client ...

Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because ...

Weakness
Out-of-bounds Read (CWE-125)
Summary

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138 regression.

Weakness
Incorrect Calculation (CWE-682)
Summary

NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include ...

Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a ...

Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times ...

Weakness
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover ...

Weakness
Improper Access Control (CWE-284)
Summary

ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.

Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.

Weakness
Improper Input Validation (CWE-20)
Summary

ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and ...

Weakness
DEPRECATED: Code (CWE-17)
Summary

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association ...

Weakness
Improper Input Validation (CWE-20)
Summary

The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, ...

Weakness
Missing Release of Memory after Effective Lifetime (CWE-401)
Summary

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in ...

Weakness
Improper Access Control (CWE-284)
Summary

The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.

Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.

Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode ...

Weakness
7PK - Security Features (CWE-254)
Summary

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a ...

Weakness
7PK - Security Features (CWE-254)
Summary

ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers ...

Weakness
DEPRECATED: Source Code (CWE-18)
Summary

NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with ...

Solution

Mitigation

  1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2

 2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:

                • Allow NTP traffic to/from trusted NTP clients only

                • Monitor the network for malicious NTP traffic going to/coming from the SIMA2

                • Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)

 3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:

                • Use trusted NTP servers only

                • Allow NTP traffic to/from trusted NTP servers only

                • Monitor the network for malicious NTP traffic targeting the SIMA2

                • Filter malicious NTP traffic targeting the SIMA2

                • Monitor NTP client operations on your SIMA2 (correctness of system time,

                  NTP-related log entries, etc.)

Remediation


Upgrade your SIMA2 to software version 2.6 or above. The NTP service of the SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.

Reported by

AUMA Riester GmbH & Co. KG thanks CERT@VDE for the support with this publication.