Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 23 May 2016 17:06:13 +0200
From: "Luis M. Merino" <luismiguelmerino@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: OpenNTPD not verifying CN during HTTPS constraints request

Good afternoon,

I'm requesting a CVE for this patched mitm mitigation bypass vulnerability
on OpenNTPD.


Upstream patch:
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/ntpd/constraint.c.diff?r1=1.27&r2=1.28

Affected versions:
All OpenNTPD versions containing constraints before May 21st 2016 are
affected.
OpenBSD 5.9 is affected.

Description:
OpenNTPD constraints is an experimental functionality to mitigate
NTP man-in-the-middle attacks. When enabled (by default on OpenBSD base
install), it request timestamps from trusted HTTPS servers through HTTP
Date: header and the average of the values obtained are used to filter
out deviating NTP responses.

Common Name verification was disabled while configuring the HTTPS request,
allowing upstream network attackers to intercept and forward the request to
a malicious server that could provide forged timestamp
constraints presenting valid certificates without the server noticing it.

The vulnerable function is httpsdate_init at
/src/usr.sbin/ntpd/constraint.c on OpenBSD source:

[...]
/* XXX we have to pre-resolve, so name and host are not equal */
tls_config_insecure_noverifyname(httpsdate->tls_config);
[...]

Solution:
Update to -CURRENT.


Regards,
Luis M. Merino

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ