Date: Thu, 14 May 2015 10:21:10 -0600 From: Kurt Seifried <kseifried@...hat.com> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, Assign a CVE Identifier <cve-assign@...re.org>, Harlan Stenn <stenn@....org> Subject: Potential issue in NTP -A option Miroslav Lichvar noticed that the -A option (disable auth) in ntpd: However the documentation seems to conflict slightly, in man ntpdc we have: ========== disable [ flag ] [ ... ] These commands operate in the same way as the enable and disable configuration file commands of ntpd. Following is a description of the flags. Note that only the auth, bclient, monitor, pll, pps and stats flags can be set by ntpdc; the pll_kernel and pps_kernel flags are read-only. auth Enables the server to synchronize with unconfigured peers only if the peer has been correctly authenticated using a trusted key and key identifier. The default for this flag is enable. ========== and in man ntpd we have: ========== -A Do not require cryptographic authentication for broadcast client, multicast client and symmetric passive associations. This is the same operation as the dis‐ able auth command and almost never a good idea. ========== In testing Miroslav found that -A disables all authentication checks including those used for mode 7 control messages (e.g. the stuff ntpdc sends). I contacted Harlan to see if he could shed any light on this, he agrees the docs should be updated, and both himself and I are not 100% sure about assigning a CVE here. I can see arguments going both ways, but ultimately I think it's enough of a gray area that it's probably best to let Mitre weight in. The main argument against would be "-A disables auth, don't do that" and the main argument for would be "the docs make it sound semi safe, so like an advertised security feature that doesn't work, that qualifies it for a CVE". This can also be patched in source to force auth to be used, but then, if -A is truly intended to disable all auth that would break that feature (which is arguably dangerous, but also useful, much like debug and information disclosure issues). -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ