Share: Email | Twitter

ID

VDE-2022-032

Published

2022-08-09 10:00 (CEST)

Last update

2022-08-09 10:01 (CEST)

Vendor(s)

AUMA Riester GmbH & Co. KG

Product(s)

Article No° Product Name Affected Version(s)
- SIMA² Master Station < V 2.6

Summary

The SIMA2 Master Station features an NTP service based on ntpd, a reference implementation of the Network Time Protocol (NTP). Affected SIMA2 Master Stations with software version < V2.6 include an outdated version of ntpd which is affected by a large number of vulnerabilities

Vulnerabilities



Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Authentication (CWE-287)
Summary

Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Out-of-bounds Write (CWE-787)
Summary

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Out-of-bounds Write (CWE-787)
Summary

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
Summary

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Use After Free (CWE-416)
Summary

Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (CWE-120)
Summary

Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Out-of-bounds Write (CWE-787)
Summary

The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Authentication (CWE-287)
Summary

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Summary

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Summary

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Summary

The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Authentication (CWE-287)
Summary

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
7PK - Time and State (CWE-361)
Summary

The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Missing Release of Resource after Effective Lifetime (CWE-772)
Summary

Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Data Processing Errors (CWE-19)
Summary

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.

Last Update
Aug. 30, 2024, 9:28 a.m.
Weakness
Origin Validation Error (CWE-346)
Summary

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

Last Update
Aug. 30, 2024, 9:28 a.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary

NTP through 4.2.8p12 has a NULL Pointer Dereference.

Last Update
Aug. 30, 2024, 9:28 a.m.
Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary

ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Out-of-bounds Read (CWE-125)
Summary

The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.

Last Update
Aug. 30, 2024, 9:28 a.m.
Weakness
Use of Insufficiently Random Values (CWE-330)
Summary

ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Data Processing Errors (CWE-19)
Summary

An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
7PK - Security Features (CWE-254)
Summary

NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.

Last Update
Aug. 30, 2024, 9:14 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Loop with Unreachable Exit Condition ('Infinite Loop') (CWE-835)
Summary

ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Summary

Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use '\' or '/' characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Data Processing Errors (CWE-19)
Summary

A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Summary

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (CWE-362)
Summary

ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Summary

The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119)
Summary

ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL value.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
NULL Pointer Dereference (CWE-476)
Summary

ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138 regression.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Out-of-bounds Read (CWE-125)
Summary

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Summary

An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.

Last Update
Aug. 30, 2024, 9:28 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Access Control (CWE-284)
Summary

ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Insufficient Information (NVD-CWE-noinfo)
Summary

ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Incorrect Calculation (CWE-682)
Summary

NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a "root distance that did not include the peer dispersion."

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
Improper Input Validation (CWE-20)
Summary

The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.

Last Update
Aug. 30, 2024, 9:13 a.m.
Weakness
DEPRECATED: Code (CWE-17)
Summary

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.

Last Update
Aug. 30, 2024, 9:28 a.m.
Weakness
Missing Release of Memory after Effective Lifetime (CWE-401)
Summary

ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Improper Access Control (CWE-284)
Summary

The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
Uncontrolled Resource Consumption (CWE-400)
Summary

The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet.

Last Update
Aug. 30, 2024, 9:29 a.m.
Weakness
7PK - Security Features (CWE-254)
Summary

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
7PK - Security Features (CWE-254)
Summary

ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock's peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.

Last Update
Aug. 30, 2024, 9:30 a.m.
Weakness
DEPRECATED: Source Code (CWE-18)
Summary

NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use.

Solution

Mitigation

  1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2

 2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:

                • Allow NTP traffic to/from trusted NTP clients only

                • Monitor the network for malicious NTP traffic going to/coming from the SIMA2

                • Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)

 3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:

                • Use trusted NTP servers only

                • Allow NTP traffic to/from trusted NTP servers only

                • Monitor the network for malicious NTP traffic targeting the SIMA2

                • Filter malicious NTP traffic targeting the SIMA2

                • Monitor NTP client operations on your SIMA2 (correctness of system time,

                  NTP-related log entries, etc.)

Remediation


Upgrade your SIMA2 to software version 2.6 or above. The NTP service of the SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.

Reported by

AUMA Riester GmbH & Co. KG thanks CERT@VDE for the support with this publication.