ntpの脆弱性201604公開分-雑まとめ
ひとまずRedHat情報で整理したものを。
"will not fix"でconf内容を見直せ、というものが結構あります。
CVE-2015-7973:Authentication Bypass by Capture-replay
CVSS v3 Base
アップデートパッケージ(RHEL)
なし
補足
Do not use NTP's broadcast mode by not configuring the "broadcast" directive in the ntp.conf file.
CVE-2015-7974:Improper Input Validation
CVSS
6.3
アップデート
なし
CVE-2015-7975:Improper Input Validation
補足
RHEL5-7のパッケージは該当せず
CVE-2015-7976:Improper Input Validation
アップデートパッケージ(RHEL)
なし
補足
Use the 'restrict default nomodify' directive in ntp.conf to disable modification of ntp.conf via the ntpq command.
CVE-2015-7977:NULL Pointer Dereference
アップデート
なし
補足
Keep the number of restriction list entries in ntp.conf lower than 500.
CVE-2015-7978:Uncontrolled Resource Consumption ('Resource Exhaustion')
CVE-2015-7979:Incorrect Synchronization
アップデートパッケージ(RHEL)
なし
補足
Do not use NTP's broadcast mode by not configuring the "broadcast" directive in the ntp.conf file.
CVE-2015-8139:Information Exposure
アップデートパッケージ(RHEL)
なし
補足
1-3のいずれかで緩和可能
(1)adding the noquery option to all restrict entries in ntp.conf,
(2)configuring ntpd to get time from multiple sources,
(3)using a restriction list in your ntp.conf to limit who is allowed to issue ntpq and ntpdc queries.
Note that ntpdc queries are disabled by default.
CVE-2015-8140:Authentication Bypass by Capture-replay
アップデートパッケージ(RHEL)
なし
補足
(1)disabling ntpq in ntp.conf,
(2)configuring ntpd to get time from multiple sources,
(3)using a restriction list in your ntp.conf to limit who is allowed to issue ntpq queries.
CVE-2015-8158:Uncontrolled Resource Consumption ('Resource Exhaustion')
アップデートパッケージ(RHEL)
なし
CVE-2016-1547:Incorrect Synchronization
未
CVE-2016-1548:Authentication Bypass by Spoofing
未
CVE-2016-1549:Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
未
CVE-2016-1550:Improper Input Validation
未
CVE-2016-1551:Authentication Bypass by Spoofing
未
CVE-2016-2516,CVE-2016-2517:Improper Input Validation
未
CVE-2016-2518:Out-of-bounds Read
未
CVE-2016-2519:Improper Restriction of Operations within the Bounds of a Memory Buffer
未
CVE-2015-7704:Improper Input Validation
アップデートパッケージ(RHEL)
CVE-2015-7705:Improper Input Validation
未
補足
Do not add the "limited" configuration option to any restrict lines in the ntp.conf file.
