diff --git a/SOURCES/ntp-4.2.6p5-cve-2014-9293.patch b/SOURCES/ntp-4.2.6p5-cve-2014-9293.patch new file mode 100644 index 0000000..62ad523 --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-cve-2014-9293.patch @@ -0,0 +1,35 @@ +diff -up ntp-4.2.6p5/ntpd/ntp_config.c.cve-2014-9293 ntp-4.2.6p5/ntpd/ntp_config.c +--- ntp-4.2.6p5/ntpd/ntp_config.c.cve-2014-9293 2014-12-19 16:24:18.297578337 +0100 ++++ ntp-4.2.6p5/ntpd/ntp_config.c 2014-12-19 16:24:18.311578368 +0100 +@@ -1866,13 +1866,16 @@ config_auth( + req_hashlen = digest_len; + #endif + } else { +- int rankey; ++ unsigned char rankey[16]; ++ ++ if (ntp_crypto_random_buf(rankey, sizeof (rankey))) { ++ msyslog(LOG_ERR, "ntp_crypto_random_buf() failed."); ++ exit(1); ++ } + +- rankey = ntp_random(); + req_keytype = NID_md5; + req_hashlen = 16; +- MD5auth_setkey(req_keyid, req_keytype, +- (u_char *)&rankey, sizeof(rankey)); ++ MD5auth_setkey(req_keyid, req_keytype, rankey, sizeof(rankey)); + authtrust(req_keyid, 1); + } + +diff -up ntp-4.2.6p5/ntpd/ntpd.c.cve-2014-9293 ntp-4.2.6p5/ntpd/ntpd.c +--- ntp-4.2.6p5/ntpd/ntpd.c.cve-2014-9293 2014-12-19 16:24:02.000000000 +0100 ++++ ntp-4.2.6p5/ntpd/ntpd.c 2014-12-19 16:24:18.298578339 +0100 +@@ -593,6 +593,7 @@ ntpdmain( + get_systime(&now); + + ntp_srandom((int)(now.l_i * now.l_uf)); ++ ntp_crypto_srandom(); + + #if !defined(VMS) + # ifndef NODETACH diff --git a/SOURCES/ntp-4.2.6p5-cve-2014-9294.patch b/SOURCES/ntp-4.2.6p5-cve-2014-9294.patch new file mode 100644 index 0000000..808ca11 --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-cve-2014-9294.patch @@ -0,0 +1,108 @@ +diff -up ntp-4.2.6p5/include/ntp_random.h.orig ntp-4.2.6p5/include/ntp_random.h +--- ntp-4.2.6p5/include/ntp_random.h.orig 2009-12-09 08:36:35.000000000 +0100 ++++ ntp-4.2.6p5/include/ntp_random.h 2014-12-19 16:01:32.450628801 +0100 +@@ -1,6 +1,9 @@ + + #include + ++void ntp_crypto_srandom(void); ++int ntp_crypto_random_buf(void *buf, size_t nbytes); ++ + long ntp_random (void); + void ntp_srandom (unsigned long); + void ntp_srandomdev (void); +diff -up ntp-4.2.6p5/libntp/ntp_random.c.orig ntp-4.2.6p5/libntp/ntp_random.c +--- ntp-4.2.6p5/libntp/ntp_random.c.orig 2009-12-09 08:36:36.000000000 +0100 ++++ ntp-4.2.6p5/libntp/ntp_random.c 2014-12-19 16:04:32.069016676 +0100 +@@ -481,3 +481,63 @@ ntp_random( void ) + } + return(i); + } ++ ++/* ++ * Crypto-quality random number functions ++ * ++ * Author: Harlan Stenn, 2014 ++ * ++ * This file is Copyright (c) 2014 by Network Time Foundation. ++ * BSD terms apply: see the file COPYRIGHT in the distribution root for details. ++ */ ++ ++#include ++#include ++ ++int crypto_rand_init = 0; ++ ++/* ++ * ntp_crypto_srandom: ++ * ++ * Initialize the random number generator, if needed by the underlying ++ * crypto random number generation mechanism. ++ */ ++ ++void ++ntp_crypto_srandom( ++ void ++ ) ++{ ++ if (!crypto_rand_init) { ++ RAND_poll(); ++ crypto_rand_init = 1; ++ } ++} ++ ++/* ++ * ntp_crypto_random_buf: ++ * ++ * Returns 0 on success, -1 on error. ++ */ ++int ++ntp_crypto_random_buf( ++ void *buf, ++ size_t nbytes ++ ) ++{ ++ int rc; ++ ++ rc = RAND_bytes(buf, nbytes); ++ if (1 != rc) { ++ unsigned long err; ++ char *err_str; ++ ++ err = ERR_get_error(); ++ err_str = ERR_error_string(err, NULL); ++ /* XXX: Log the error */ ++ ++ return -1; ++ } ++ return 0; ++} ++ +diff -up ntp-4.2.6p5/util/ntp-keygen.c.orig ntp-4.2.6p5/util/ntp-keygen.c +--- ntp-4.2.6p5/util/ntp-keygen.c.orig 2014-12-19 15:27:38.375236349 +0100 ++++ ntp-4.2.6p5/util/ntp-keygen.c 2014-12-19 15:58:00.006170042 +0100 +@@ -263,6 +263,8 @@ main( + ssl_check_version(); + #endif /* OPENSSL */ + ++ ntp_crypto_srandom(); ++ + /* + * Process options, initialize host name and timestamp. + */ +@@ -743,7 +745,14 @@ gen_md5( + int temp; + + while (1) { +- temp = ntp_random() & 0xff; ++ int rc; ++ ++ rc = ntp_crypto_random_buf(&temp, 1); ++ if (-1 == rc) { ++ fprintf(stderr, "ntp_crypto_random_buf() failed.\n"); ++ exit (-1); ++ } ++ temp &= 0xff; + if (temp == '#') + continue; + diff --git a/SOURCES/ntp-4.2.6p5-cve-2014-9295.patch b/SOURCES/ntp-4.2.6p5-cve-2014-9295.patch new file mode 100644 index 0000000..97fcc3a --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-cve-2014-9295.patch @@ -0,0 +1,110 @@ +2014-12-12 11:06:03+00:00, stenn@psp-fb1.ntp.org +12 -3 + [Sec 2667] buffer overflow in crypto_recv() + +--- 1.168/ntpd/ntp_crypto.c 2014-11-15 04:41:02 +00:00 ++++ 1.169/ntpd/ntp_crypto.c 2014-12-12 11:06:03 +00:00 +@@ -820,15 +820,24 @@ crypto_recv( + * errors. + */ + if (vallen == (u_int)EVP_PKEY_size(host_pkey)) { ++ u_int32 *cookiebuf = malloc( ++ RSA_size(host_pkey->pkey.rsa)); ++ if (!cookiebuf) { ++ rval = XEVNT_CKY; ++ break; ++ } ++ + if (RSA_private_decrypt(vallen, + (u_char *)ep->pkt, +- (u_char *)&temp32, ++ (u_char *)cookiebuf, + host_pkey->pkey.rsa, +- RSA_PKCS1_OAEP_PADDING) <= 0) { ++ RSA_PKCS1_OAEP_PADDING) != 4) { + rval = XEVNT_CKY; ++ free(cookiebuf); + break; + } else { +- cookie = ntohl(temp32); ++ cookie = ntohl(*cookiebuf); ++ free(cookiebuf); + } + } else { + rval = XEVNT_CKY; + +2014-12-12 11:13:40+00:00, stenn@psp-fb1.ntp.org +16 -1 + [Sec 2668] buffer overflow in ctl_putdata() + +--- 1.190/ntpd/ntp_control.c 2014-11-15 04:41:02 +00:00 ++++ 1.191/ntpd/ntp_control.c 2014-12-12 11:13:40 +00:00 +@@ -801,6 +801,10 @@ static char *reqend; + static char *reqpt; + static char *reqend; + ++#ifndef MIN ++#define MIN(a, b) (((a) <= (b)) ? (a) : (b)) ++#endif ++ + /* + * init_control - initialize request data + */ +@@ -1316,6 +1320,7 @@ ctl_putdata( + ) + { + int overhead; ++ unsigned int currentlen; + + overhead = 0; + if (!bin) { +@@ -1338,12 +1343,22 @@ ctl_putdata( + /* + * Save room for trailing junk + */ +- if (dlen + overhead + datapt > dataend) { ++ while (dlen + overhead + datapt > dataend) { + /* + * Not enough room in this one, flush it out. + */ ++ currentlen = MIN(dlen, dataend - datapt); ++ ++ memcpy(datapt, dp, currentlen); ++ ++ datapt += currentlen; ++ dp += currentlen; ++ dlen -= currentlen; ++ datalinelen += currentlen; ++ + ctl_flushpkt(CTL_MORE); + } ++ + memmove((char *)datapt, dp, (unsigned)dlen); + datapt += dlen; + datalinelen += dlen; + +2014-12-12 11:19:37+00:00, stenn@psp-fb1.ntp.org +14 -0 + [Sec 2669] buffer overflow in configure() + +--- 1.191/ntpd/ntp_control.c 2014-12-12 11:13:40 +00:00 ++++ 1.192/ntpd/ntp_control.c 2014-12-12 11:19:37 +00:00 +@@ -3290,6 +3290,20 @@ static void configure( + + /* Initialize the remote config buffer */ + data_count = reqend - reqpt; ++ ++ if (data_count > sizeof(remote_config.buffer) - 2) { ++ snprintf(remote_config.err_msg, ++ sizeof(remote_config.err_msg), ++ "runtime configuration failed: request too long"); ++ ctl_putdata(remote_config.err_msg, ++ strlen(remote_config.err_msg), 0); ++ ctl_flushpkt(0); ++ msyslog(LOG_NOTICE, ++ "runtime config from %s rejected: request too long", ++ stoa(&rbufp->recv_srcadr)); ++ return; ++ } ++ + memcpy(remote_config.buffer, reqpt, data_count); + if (data_count > 0 + && '\n' != remote_config.buffer[data_count - 1]) + diff --git a/SOURCES/ntp-4.2.6p5-cve-2014-9296.patch b/SOURCES/ntp-4.2.6p5-cve-2014-9296.patch new file mode 100644 index 0000000..323c67b --- /dev/null +++ b/SOURCES/ntp-4.2.6p5-cve-2014-9296.patch @@ -0,0 +1,14 @@ +2014-12-12 11:24:22+00:00, stenn@psp-fb1.ntp.org +1 -0 + [Sec 2670] Missing return; from error clause + +--- 1.350/ntpd/ntp_proto.c 2014-11-21 11:06:57 +00:00 ++++ 1.351/ntpd/ntp_proto.c 2014-12-12 11:24:22 +00:00 +@@ -1089,6 +1089,7 @@ receive( + fast_xmit(rbufp, MODE_ACTIVE, 0, + restrict_mask); + sys_restricted++; ++ return; + } + } + + diff --git a/SPECS/ntp.spec b/SPECS/ntp.spec index 28cd8ca..1b5a019 100644 --- a/SPECS/ntp.spec +++ b/SPECS/ntp.spec @@ -1,7 +1,7 @@ Summary: The NTP daemon and utilities Name: ntp Version: 4.2.6p5 -Release: 18%{?dist} +Release: 19%{?dist} # primary license (COPYRIGHT) : MIT # ElectricFence/ (not used) : GPLv2 # kernel/sys/ppsclock.h (not used) : BSD with advertising @@ -89,6 +89,14 @@ Patch19: ntp-4.2.6p5-pwcipher.patch Patch20: ntp-4.2.6p5-noservres.patch # ntpbz #2506 Patch21: ntp-4.2.6p5-refreshroute.patch +# ntpbz #2666 +Patch22: ntp-4.2.6p5-cve-2014-9294.patch +# ntpbz #2665 +Patch23: ntp-4.2.6p5-cve-2014-9293.patch +# ntpbz #2667 +Patch24: ntp-4.2.6p5-cve-2014-9295.patch +# ntpbz #2670 +Patch25: ntp-4.2.6p5-cve-2014-9296.patch # handle unknown clock types Patch50: ntpstat-0.2-clksrc.patch @@ -169,7 +177,7 @@ This package contains NTP documentation in HTML format. # pool.ntp.org vendor zone which will be used in ntp.conf %if 0%{!?vendorzone:1} %{?fedora: %global vendorzone fedora.} -%{?rhel: %global vendorzone centos.} +%{?rhel: %global vendorzone rhel.} %endif %prep @@ -198,6 +206,10 @@ This package contains NTP documentation in HTML format. %patch19 -p1 -b .pwcipher %patch20 -p1 -b .noservres %patch21 -p1 -b .refreshroute +%patch22 -p1 -b .cve-2014-9294 +%patch23 -p1 -b .cve-2014-9293 +%patch24 -p1 -b .cve-2014-9295 +%patch25 -p1 -b .cve-2014-9296 # ntpstat patches %patch50 -p1 -b .clksrc @@ -409,8 +421,11 @@ popd %{ntpdocdir}/html %changelog -* Wed Jun 18 2014 Jim Perrin - 4.2.6p5-18.el7.centos -- rebrand vendorzone +* Fri Dec 19 2014 Miroslav Lichvar 4.2.6p5-19 +- don't generate weak control key for resolver (CVE-2014-9293) +- don't generate weak MD5 keys in ntp-keygen (CVE-2014-9294) +- fix buffer overflows via specially-crafted packets (CVE-2014-9295) +- don't mobilize passive association when authentication fails (CVE-2014-9296) * Tue Feb 11 2014 Miroslav Lichvar 4.2.6p5-18 - disable monitor in default ntp.conf (#1047856)