読者です 読者をやめる 読者になる 読者になる

ntpの脆弱性201604公開分-雑まとめ

ひとまずRedHat情報で整理したものを。
"will not fix"でconf内容を見直せ、というものが結構あります。

CVE-2015-7973:Authentication Bypass by Capture-replay

CVSS v3 Base

アップデートパッケージ(RHEL)

なし

補足

Do not use NTP's broadcast mode by not configuring the "broadcast" directive in the ntp.conf file.

CVE-2015-7974:Improper Input Validation

CVSS

6.3

アップデート

なし

CVE-2015-7975:Improper Input Validation

補足

RHEL5-7のパッケージは該当せず

CVE-2015-7976:Improper Input Validation

アップデートパッケージ(RHEL)

なし

補足

Use the 'restrict default nomodify' directive in ntp.conf to disable modification of ntp.conf via the ntpq command.

CVE-2015-7977:NULL Pointer Dereference

アップデート

なし

補足

Keep the number of restriction list entries in ntp.conf lower than 500.

CVE-2015-7978:Uncontrolled Resource Consumption ('Resource Exhaustion')

アップデートパッケージ(RHEL)

なし

補足

Keep the number of restriction list entries in ntp.conf lower than 500.

CVE-2015-7979:Incorrect Synchronization

アップデートパッケージ(RHEL)

なし

補足

Do not use NTP's broadcast mode by not configuring the "broadcast" directive in the ntp.conf file.

CVE-2015-8138:Improper Input Validation

CVSS v3 Base

(Important)

アップデートパッケージ(RHEL)

https://rhn.redhat.com/errata/RHSA-2016-0063.html

CVE-2015-8139:Information Exposure

アップデートパッケージ(RHEL)

なし

補足

1-3のいずれかで緩和可能
(1)adding the noquery option to all restrict entries in ntp.conf,
(2)configuring ntpd to get time from multiple sources,
(3)using a restriction list in your ntp.conf to limit who is allowed to issue ntpq and ntpdc queries.
Note that ntpdc queries are disabled by default.

CVE-2015-8140:Authentication Bypass by Capture-replay

アップデートパッケージ(RHEL)

なし

補足

(1)disabling ntpq in ntp.conf,
(2)configuring ntpd to get time from multiple sources,
(3)using a restriction list in your ntp.conf to limit who is allowed to issue ntpq queries.

CVE-2015-8158:Uncontrolled Resource Consumption ('Resource Exhaustion')

アップデートパッケージ(RHEL)

なし

CVE-2016-1547:Incorrect Synchronization

CVE-2016-1548:Authentication Bypass by Spoofing

CVE-2016-1549:Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2016-1550:Improper Input Validation

CVE-2016-1551:Authentication Bypass by Spoofing

CVE-2016-2516,CVE-2016-2517:Improper Input Validation

CVE-2016-2518:Out-of-bounds Read

CVE-2016-2519:Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-7704:Improper Input Validation

アップデートパッケージ(RHEL)

https://rhn.redhat.com/errata/RHSA-2015-1930.html

CVE-2015-7705:Improper Input Validation

補足

Do not add the "limited" configuration option to any restrict lines in the ntp.conf file.