Meinberg Security Advisory: [MBGSA-1605] NTP and others

The Network Time Foundation released a new version of NTP which addresses a number of security vulnerabilities. This new NTP version 4.2.8p9 has been included in the latest Meinberg LTOS6 release together with a number of other security fixes addressing vulnerabilities in the Linux kernel as well as OpenSSH and OpenSSL.

CVE-IDs:

NTP: CVE-2016-9311 CVE-2016-9310 CVE-2016-7427 CVE-2016-7428 CVE-2016-7431 CVE-2016-7434 CVE-2016-7429 CVE-2016-7426 CVE-2016-7433

Linux Kernel: CVE-2016-5195

OpenSSH: CVE-2016-6210 CVE-2015-8325

OpenSSL: CVE-2016-6304 CVE-2016-6305 CVE-2016-2183 CVE-2016-6303 CVE-2016-6302 CVE-2016-2182 CVE-2016-2180 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2181 CVE-2016-6306 CVE-2016-6307 CVE-2016-6308

1. Description of the Problem

Multiple medium and low severity vulnerabilities have been identified in NTP versions including 4.2.8p8 and prior to 4.2.8p8, they have been addressed in a new version 4.2.8p9 which has been released today. Additionally, a recently detected vulnerability in the Linux kernel allowing a local unprivileged user to gain write access to otherwise read-only memory. This could be abused to execute arbitrary code or modify binary files on the system to execute malicious code. This vulnerability has been nicknamed "Dirty Cow" and is in Linux kernels since more than 11 years.

Recently published updates for OpenSSL (version 1.0.2j) and OpenSSH (version 7.3p1 also address a number of vulnerabilities, more details can be found in the release notes of the affected software components (see below).

2. Affected Systems

All LANTIME, SyncFire and LCES Firmware Versions before 6.20.014 are affected by these vulnerabilities. The Dirty Cow vulnerability requires a local unprivileged user to be able to execute own binaries on the system, which is in general not possible on LTOS6 versions and would require exploiting another security vulnerability.

The Windows Installer for NTP is also affected. Especially CVE-2016-9312 is a vulnerability that is Windows specific and has been assigned a "high" severity level.

3. Possible Defense Strategies

Meinberg Products

The fixes for all the described vulnerabilities are included in 6.20.014 which is available as of today.

Although the vulnerabilities affecting Meinberg LANTIME systems running firmware versions 6.x have been assigned a "low" or "medium" severity level, due to the sheer number of included security fixes Meinberg strongly recommends you to update your LANTIME devices as soon as possible by installing LTOS 6.20.014 (a download link can be requested below).

Meinberg LANTIME Firmware Updates

For V5 versions and older V6 versions we also strongly recommend to update to 6.20.014 as soon as possible. Please contact your Meinberg support for assistance or in case of questions.

Windows NTP Installations

Meinberg provides a free of charge NTP installer which is available from our NTP for Windows download page. The latest version already installs NTP 4.2.8p9, the installer will ask you if you want to only update the binaries if it detects an existing installation. It is sufficient to use this quick update function in order to install 4.2.8p9 and therefore fix the vulnerabilities.

Other NTP Installations

Please contact your OS vendor to find out how to protect your systems and how to update to ntp-4.2.8p9, if possible.

4. Additional Information Sources

More about this topic can be found on the following websites:

NTP 4.2.8p9 announcement on the Network Time Foundation website
OpenSSL Security Advisory 160926 describing the vulnerabilities fixed by OpenSSL 1.0.2j
OpenSSL Security Advisory 160922 describing the vulnerabilities fixed by OpenSSL 1.0.2i
OpenSSH 7.3 release notes describing fixes and improvements

Please do not hesitate to reach out to your Meinberg support contact if you need further assistance or have additional questions.