summaryrefslogtreecommitdiff
path: root/net/ntp4
AgeCommit message (Collapse)AuthorFilesLines
2015-04-08Update ntp4 package to 4.2.8p2.taca3-7/+8
NTP 4.2.8p2 (Harlan Stenn <stenn@ntp.org>, 2015/04/xx) Focus: Security and Bug fixes, enhancements. Severity: MEDIUM In addition to bug fixes and enhancements, this release fixes the following medium-severity vulnerabilities involving private key authentication: * [Sec 2779] ntpd accepts unauthenticated packets with symmetric key crypto. References: Sec 2779 / CVE-2015-1798 / VU#374268 Affects: All NTP4 releases starting with ntp-4.2.5p99 up to but not including ntp-4.2.8p2 where the installation uses symmetric keys to authenticate remote associations. CVSS: (AV:A/AC:M/Au:N/C:P/I:P/A:P) Base Score: 5.4 Date Resolved: Stable (4.2.8p2) 07 Apr 2015 Summary: When ntpd is configured to use a symmetric key to authenticate a remote NTP server/peer, it checks if the NTP message authentication code (MAC) in received packets is valid, but not if there actually is any MAC included. Packets without a MAC are accepted as if they had a valid MAC. This allows a MITM attacker to send false packets that are accepted by the client/peer without having to know the symmetric key. The attacker needs to know the transmit timestamp of the client to match it in the forged reply and the false reply needs to reach the client before the genuine reply from the server. The attacker doesn't necessarily need to be relaying the packets between the client and the server. Authentication using autokey doesn't have this problem as there is a check that requires the key ID to be larger than NTP_MAXKEY, which fails for packets without a MAC. Mitigation: Upgrade to 4.2.8p2, or later, from the NTP Project Download Page or the NTP Public Services Project Download Page Configure ntpd with enough time sources and monitor it properly. Credit: This issue was discovered by Miroslav Lichvar, of Red Hat. * [Sec 2781] Authentication doesn't protect symmetric associations against DoS attacks. References: Sec 2781 / CVE-2015-1799 / VU#374268 Affects: All NTP releases starting with at least xntp3.3wy up to but not including ntp-4.2.8p2 where the installation uses symmetric key authentication. CVSS: (AV:A/AC:M/Au:N/C:P/I:P/A:P) Base Score: 5.4 Note: the CVSS base Score for this issue could be 4.3 or lower, and it could be higher than 5.4. Date Resolved: Stable (4.2.8p2) 07 Apr 2015 Summary: An attacker knowing that NTP hosts A and B are peering with each other (symmetric association) can send a packet to host A with source address of B which will set the NTP state variables on A to the values sent by the attacker. Host A will then send on its next poll to B a packet with originate timestamp that doesn't match the transmit timestamp of B and the packet will be dropped. If the attacker does this periodically for both hosts, they won't be able to synchronize to each other. This is a known denial-of-service attack, described at https://www.eecis.udel.edu/~mills/onwire.html . According to the document the NTP authentication is supposed to protect symmetric associations against this attack, but that doesn't seem to be the case. The state variables are updated even when authentication fails and the peers are sending packets with originate timestamps that don't match the transmit timestamps on the receiving side. This seems to be a very old problem, dating back to at least xntp3.3wy. It's also in the NTPv3 (RFC 1305) and NTPv4 (RFC 5905) specifications, so other NTP implementations with support for symmetric associations and authentication may be vulnerable too. An update to the NTP RFC to correct this error is in-process. Mitigation: Upgrade to 4.2.8p2, or later, from the NTP Project Download Page or the NTP Public Services Project Download Page Note that for users of autokey, this specific style of MITM attack is simply a long-known potential problem. Configure ntpd with appropriate time sources and monitor ntpd. Alert your staff if problems are detected. Credit: This issue was discovered by Miroslav Lichvar, of Red Hat. * New script: update-leap The update-leap script will verify and if necessary, update the leap-second definition file. It requires the following commands in order to work: wget logger tr sed shasum Some may choose to run this from cron. It needs more portability testing.
2015-03-21SECURITY: Update ntpd to 4.2.8p1.bsiegert4-681/+475
* [Sec 2671] vallen in extension fields are not validated. * [Sec 2672] On some OSes ::1 can be spoofed, bypassing source IP ACLs.
2015-02-28Look deeper for config.guess/config.sub.joerg1-1/+3
2014-12-27Create minimum services files on chroot environment as recenttaca2-2/+19
NetBSD current. Bump PKGREVISION.
2014-12-20Update ntpd4 pacakge to 4.2.8, here is summary for security related fixes.taca6-25/+238
NTP 4.2.8 (Harlan Stenn <stenn@ntp.org>, 2014/12/18) Focus: Security and Bug fixes, enhancements. Severity: HIGH In addition to bug fixes and enhancements, this release fixes the following high-severity vulnerabilities: * Weak default key in config_auth(). References: [Sec 2665] / CVE-2014-9293 / VU#852879 CVSS: (AV:N/AC:L/Au:M/C:P/I:P/A:C) Base Score: 7.3 Vulnerable Versions: all releases prior to 4.2.7p11 Date Resolved: 28 Jan 2010 Summary: If no 'auth' key is set in the configuration file, ntpd would generate a random key on the fly. There were two problems with this: 1) the generated key was 31 bits in size, and 2) it used the (now weak) ntp_random() function, which was seeded with a 32-bit value and could only provide 32 bits of entropy. This was sufficient back in the late 1990s when the code was written. Not today. Mitigation: Upgrade to 4.2.7p11 or later. Credit: This vulnerability was noticed in ntp-4.2.6 by Neel Mehta of the Google Security Team. * Non-cryptographic random number generator with weak seed used by ntp-keygen to generate symmetric keys. References: [Sec 2666] / CVE-2014-9294 / VU#852879 CVSS: (AV:N/AC:L/Au:M/C:P/I:P/A:C) Base Score: 7.3 Vulnerable Versions: All NTP4 releases before 4.2.7p230 Date Resolved: Dev (4.2.7p230) 01 Nov 2011 Summary: Prior to ntp-4.2.7p230 ntp-keygen used a weak seed to prepare a random number generator that was of good quality back in the late 1990s. The random numbers produced was then used to generate symmetric keys. In ntp-4.2.8 we use a current-technology cryptographic random number generator, either RAND_bytes from OpenSSL, or arc4random(). Mitigation: Upgrade to 4.2.7p230 or later. Credit: This vulnerability was discovered in ntp-4.2.6 by Stephen Roettger of the Google Security Team. * Buffer overflow in crypto_recv() References: Sec 2667 / CVE-2014-9295 / VU#852879 CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5 Versions: All releases before 4.2.8 Date Resolved: Stable (4.2.8) 18 Dec 2014 Summary: When Autokey Authentication is enabled (i.e. the ntp.conf file contains a 'crypto pw ...' directive) a remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process. Mitigation: Upgrade to 4.2.8, or later, or Disable Autokey Authentication by removing, or commenting out, all configuration directives beginning with the crypto keyword in your ntp.conf file. Credit: This vulnerability was discovered by Stephen Roettger of the Google Security Team. * Buffer overflow in ctl_putdata() References: Sec 2668 / CVE-2014-9295 / VU#852879 CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5 Versions: All NTP4 releases before 4.2.8 Date Resolved: Stable (4.2.8) 18 Dec 2014 Summary: A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process. Mitigation: Upgrade to 4.2.8, or later. Credit: This vulnerability was discovered by Stephen Roettger of the Google Security Team. * Buffer overflow in configure() References: Sec 2669 / CVE-2014-9295 / VU#852879 CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5 Versions: All NTP4 releases before 4.2.8 Date Resolved: Stable (4.2.8) 18 Dec 2014 Summary: A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process. Mitigation: Upgrade to 4.2.8, or later. Credit: This vulnerability was discovered by Stephen Roettger of the Google Security Team. * receive(): missing return on error References: Sec 2670 / CVE-2014-9296 / VU#852879 CVSS: (AV:N/AC:L/Au:N/C:N/I:N/A:P) Base Score: 5.0 Versions: All NTP4 releases before 4.2.8 Date Resolved: Stable (4.2.8) 18 Dec 2014 Summary: Code in ntp_proto.c:receive() was missing a 'return;' in the code path where an error was detected, which meant processing did not stop when a specific rare error occurred. We haven't found a way for this bug to affect system integrity. If there is no way to affect system integrity the base CVSS score for this bug is 0. If there is one avenue through which system integrity can be partially affected, the base score becomes a 5. If system integrity can be partially affected via all three integrity metrics, the CVSS base score become 7.5. Mitigation: Upgrade to 4.2.8, or later, or Remove or comment out all configuration directives beginning with the crypto keyword in your ntp.conf file. Credit: This vulnerability was discovered by Stephen Roettger of the Google Security Team. See http://support.ntp.org/security for more information.
2014-10-09Remove pkgviews: don't set PKG_INSTALLATION_TYPES in Makefiles.wiz1-3/+1
2014-05-29Bump for perl-5.20.0.wiz1-2/+2
Do it for all packages that * mention perl, or * have a directory name starting with p5-*, or * depend on a package starting with p5- like last time, for 5.18, where this didn't lead to complaints. Let me know if you have any this time.
2014-03-20More files observed on FreeBSD.asau1-2/+2
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-3/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-03-05Fixes PKGNAME, '-dev-' should not be there.obache1-1/+2
2014-03-05Fixes path names, changed at switched to 4.2.7-dev snapshot release.obache2-4/+4
PR pkg/48590 by Jason White.
2014-02-18Restrict the explicit -lgcc_s to Linux as the comment indicates where itjoerg3-1/+33
is aimed at.
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-1/+2
2014-01-12update to ntp latest dev version to deal with CVE-2013-5211spz6-107/+392
(amplification attacks using monlist queries) tickadj for Solaris is a guess (and probably version dependent) the bulk builds will tell :)
2013-07-15* .include "../../devel/readline/buildlink3.mk" with USE_GNU_READLINE=yesryoon1-2/+2
are replaced with .include "../../devel/readline/buildlink3.mk", and USE_GNU_READLINE are removed, * .include "../../devel/readline/buildlink3.mk" without USE_GNU_READLINE are replaced with .include "../../mk/readline.buildlink3.mk".
2013-05-31Bump all packages for perl-5.18, thatwiz1-2/+2
a) refer 'perl' in their Makefile, or b) have a directory name of p5-*, or c) have any dependency on any p5-* package Like last time, where this caused no complaints.
2013-02-06PKGREVISION bumps for the security/openssl 1.0.1d update.jperkin1-2/+2
2012-10-23Drop superfluous PKG_DESTDIR_SUPPORT, "user-destdir" is default these days.asau1-2/+1
2012-10-03Bump all packages that use perl, or depend on a p5-* package, orwiz1-2/+2
are called p5-*. I hope that's all of them.
2012-06-12Add inet6 to default suggested options. It's 2012.wiz1-1/+2
2012-04-08POSIX says that the target directory for "pax -rw" must exist. The paxbsiegert1-1/+3
implementation in MirBSD enforces this. Use ${MKDIR} to create the target directory before running pax. This does not actually fix the build on MirBSD (it needs some more work in the configure), it is at least a start.
2011-11-16Add missing devel/readline buildlinks.sbd1-2/+3
Bump PKGREVISIONs
2010-01-17Recursive PKGREVISION bump for jpeg update to 8.wiz1-1/+2
2009-12-21patch-aa: fix copy-paste errortnn3-4/+21
patch-ab: don't install man1/sntp.1 twice
2009-12-21fix build with glibc-2.10.1+tnn2-1/+21
patch from gentoo bug 270483
2009-12-15Update to ntp-4.2.4p8. Security fix for CVE-2009-3563 DoS vulnerability.tnn2-7/+6
2009-10-11update master_sites. ftp.udel.edu has been suspended.zafer1-3/+2
2009-09-08needs -D_GNU_SOURCE on Linux for struct in6_pktinfotnn1-1/+3
2009-09-08Build with chroot jail support on platforms that support it.tnn1-2/+11
2009-09-08make net/ntp4 properly IPv6 awaretnn2-1/+19
2009-09-06fix PLIST breakage on Linuxtnn1-2/+2
2009-09-06NTP 4.2.4p7, 2009/05/04tnn2-6/+6
Focus: Security and Bug Fixes Severity: HIGH This release fixes the following high-severity vulnerability: * [Sec 1151] Remote exploit if autokey is enabled. CVE-2009-1252 See http://support.ntp.org/security for more information. If autokey is enabled (if ntp.conf contains a "crypto pw whatever" line) then a carefully crafted packet sent to the machine will cause a buffer overflow and possible execution of injected code, running with the privileges of the ntpd process (often root). Credit for finding this vulnerability goes to Chris Ries of CMU. This release fixes the following low-severity vulnerabilities: * [Sec 1144] limited (two byte) buffer overflow in ntpq. CVE-2009-0159 Credit for finding this vulnerability goes to Geoff Keating of Apple. * [Sec 1149] use SO_EXCLUSIVEADDRUSE on Windows Credit for finding this issue goes to Dave Hart. This release fixes a number of bugs and adds some improvements: * Improved logging * Fix many compiler warnings * Many fixes and improvements for Windows * Adds support for AIX 6.1 * Resolves some issues under MacOS X and Solaris
2009-06-14Remove @dirrm entries from PLISTsjoerg1-12/+1
2009-01-26Update to 4.2.4p6. Highlights from 4.2.4p4:kefren2-7/+6
* fix CVE-2009-0021 * fix build against latest OpenSSL versions * obsolete "dynamic" keyword * fix memory leak when fetching system messages * several fixes in ntpdate
2008-06-24Fixed PLIST for Solaris, installs ntptime but not tickadj.obache2-4/+7
Noticed by John Heasley in PR 39033.
2008-06-24Fixes some problems noticed by Hasso Tepper in PR 39032.obache2-5/+7
* Fix perl path in scripts, add runtime dependency on perl. * Fix unwanted PLIST subst. * DragonFly also support ntptime. Bump PKGREVISION.
2008-06-08Update ntp to 4.2.4p4.obache5-86/+81
--- (4.2.4p4) Released by Harlan Stenn <stenn@ntp.org> * [Bug 902] Fix problems with the -6 flag. * Updated include/copyright.def (owner and year). * [Bug 878] Avoid ntpdc use of refid value as unterminated string. * [Bug 881] Corrected display of pll offset on 64bit systems. * [Bug 886] Corrected sign handling on 64bit in ntpdc loopinfo command. * [Bug 889] avoid malloc() interrupted by SIGIO risk * ntpd/refclock_parse.c: cleanup shutdown while the file descriptor is still open. * [Bug 885] use emalloc() to get a message at the end of the memory unsigned types cannot be less than 0 default_ai_family is a short lose trailing , from enum list clarify ntp_restrict.c for easier automated analysis * [Bug 884] don't access recv buffers after having them passed to the free list. * [Bug 882] allow loopback interfaces to share addresses with other interfaces. --- (4.2.4p3) Released by Harlan Stenn <stenn@ntp.org> * [Bug 863] unable to stop ntpd on Windows as the handle reference for events changed --- (4.2.4p2) Released by Harlan Stenn <stenn@ntp.org> * [Bug 854] Broadcast address was not correctly set for interface addresses * [Bug 829] reduce syslog noise, while there fix Enabled/Disable logging to reflect the actual configuration. * [Bug 795] Moved declaration of variable to top of function. * [Bug 789] Fix multicast client crypto authentication and make sure arriving multicast packets do not disturb the autokey dance. * [Bug 785] improve handling of multicast interfaces (multicast routers still need to run a multicast routing software/daemon) * [Bug 527] Don't write from source address length to wrong location * Upgraded autogen and libopts. * [Bug 811] ntpd should not read a .ntprc file. --- (4.2.4p1) (skipped) --- (4.2.4p0) Released by Harlan Stenn <stenn@ntp.org> * [Bug 793] Update Hans Lambermont's email address in ntpsweep. * [Bug 776] Remove unimplemented "rate" flag from ntpdate. * [Bug 586] Avoid lookups if AI_NUMERICHOST is set. * [Bug 770] Fix numeric parameters to ntp-keygen (Alain Guibert). * [Bug 768] Fix io_setbclient() error message. * [Bug 765] Use net_bind_service capability on linux. * [Bug 760] The background resolver must be aware of the 'dynamic' keyword. * [Bug 753] make union timestamp anonymous (Philip Prindeville). * confopt.html: move description for "dynamic" keyword into the right section. * pick the right type for the recv*() length argument. --- (4.2.4) Released by Harlan Stenn <stenn@ntp.org> * monopt.html fixes from Dave Mills. * [Bug 452] Do not report kernel PLL/FLL flips. * [Bug 746] Expert mouseCLOCK USB v2.0 support added.' * driver8.html updates. * [Bug 747] Drop <NOBR> tags from ntpdc.html. * sntp now uses the returned precision to control decimal places. * sntp -u will use an unprivileged port for its queries. * [Bug 741] "burst" doesn't work with !unfit peers. * [Bug 735] Fix a make/gmake VPATH issue on Solaris. * [Bug 739] ntpd -x should not take an argument. * [Bug 737] Some systems need help providing struct iovec. * [Bug 717] Fix libopts compile problem. * [Bug 728] parse documentation fixes. * [Bug 734] setsockopt(..., IP_MULTICAST_IF, ...) fails on 64-bit platforms. * [Bug 732] C-DEX JST2000 patch from Hideo Kuramatsu. * [Bug 721] check for __ss_family and __ss_len separately. * [Bug 666] ntpq opeers displays jitter rather than dispersion. * [Bug 718] Use the recommended type for the saddrlen arg to getsockname(). * [Bug 715] Fix a multicast issue under Linux. * [Bug 690] Fix a Windows DNS lookup buffer overflow. * [Bug 670] Resolved a Windows issue with the dynamic interface rescan code. * K&R C support is being deprecated. * [Bug 714] ntpq -p should conflict with -i, not -c. * WWV refclock improvements from Dave Mills. * [Bug 708] Use thread affinity only for the clock interpolation thread. * [Bug 706] ntpd can be running several times in parallel. * [Bug 704] Documentation typos. * [Bug 701] coverity: NULL dereference in ntp_peer.c * [Bug 695] libopts does not protect against macro collisions. * [Bug 693] __adjtimex is independent of ntp_{adj,get}time. * [Bug 692] sys_limitrejected was not being incremented. * [Bug 691] restrictions() assumption not always valid. * [Bug 689] Deprecate HEATH GC-1001 II; the driver never worked. * [Bug 688] Fix documentation typos. * [Bug 686] Handle leap seconds better under Windows. * [Bug 685] Use the Windows multimedia timer. * [Bug 684] Only allow debug options if debugging is enabled. * [Bug 683] Use the right version string. * [Bug 680] Fix the generated version string on Windows. * [Bug 678] Use the correct size for control messages. * [Bug 677] Do not check uint_t in configure.ac. * [Bug 676] Use the right value for msg_namelen. * [Bug 675] Make sure ntpd builds without debugging. * [Bug 672] Fix cross-platform structure padding/size differences. * [Bug 660] New TIMESTAMP code fails tp build on Solaris Express. * [Bug 659] libopts does not build under Windows. * [Bug 658] HP-UX with cc needs -Wp,-H8166 in CFLAGS. * [Bug 656] ntpdate doesn't work with multicast address. * [Bug 638] STREAMS_TLI is deprecated - remove it. * [Bug 635] Fix tOptions definition. * [Bug 628] Fallback to ntp discipline not working for large offsets. * [Bug 622] Dynamic interface tracking for ntpd. * [Bug 603] Don't link with libelf if it's not needed. * [Bug 523] ntpd service under Windows does't shut down properly. * [Bug 500] sntp should always be built. * [Bug 479] Fix the -P option. * [Bug 421] Support the bc637PCI-U card. * [Bug 342] Deprecate broken TRAK refclock driver. * [Bug 340] Deprecate broken MSF EES refclock driver. * [Bug 153] Don't do DNS lookups on address masks. * [Bug 143] Fix interrupted system call on HP-UX. * [Bug 42] Distribution tarballs should be signed. * Support separate PPS devices for PARSE refclocks. * [Bug 637, 51?] Dynamic interface scanning can now be done. * Options processing now uses GNU AutoGen. --- (4.2.2p4) Released by Harlan Stenn <stenn@ntp.org> * [Bug 710] compat getnameinfo() has off-by-one error * [Bug 690] Buffer overflow in Windows when doing DNS Lookups --- (4.2.2p3) Released by Harlan Stenn <stenn@ntp.org> * Make the ChangeLog file cleaner and easier to read * [Bug 601] ntpq's decodeint uses an extra level of indirection * [Bug 657] Different OSes need different sized args for IP_MULTICAST_LOOP * release engineering/build changes * Documentation fixes * Get sntp working under AIX-5 --- (4.2.2p2) (broken) * Get sntp working under AIX-5 --- (4.2.2p1) * [Bug 661] Use environment variable to specify the base path to openssl. * Resolve an ambiguity in the copyright notice * Added some new documentation files * URL cleanup in the documentation * [Bug 657]: IP_MULTICAST_LOOP uses a u_char value/size * quiet gcc4 complaints * more Coverity fixes * [Bug 614] manage file descriptors better * [Bug 632] update kernel PPS offsets when PPS offset is re-configured * [Bug 637] Ignore UP in*addr_any interfaces * [Bug 633] Avoid writing files in srcdir * release engineering/build changes --- (4.2.2) * SNTP * Many bugfixes * Implements the current "goal state" of NTPv4 * Autokey improvements * Much better IPv6 support * [Bug 360] ntpd loses handles with LAN connection disabled. * [Bug 239] Fix intermittent autokey failure with multicast clients. * Rewrite of the multicast code * New version numbering scheme
2008-05-26Second round of explicit pax dependencies. As reminded by tnn@,joerg1-4/+4
many packages used to use ${PAX}. Use the common way of directly calling pax, it is created as tool after all.
2008-04-12Convert to use PLIST_VARS instead of manually passing "@comment "jlam2-13/+8
through PLIST_SUBST to the plist module.
2008-01-24Correct PLIST on Solaris (From PR 33259 by spz@).is1-1/+3
2008-01-18Per the process outlined in revbump(1), perform a recursive revbumptnn1-2/+2
on packages that are affected by the switch from the openssl 0.9.7 branch to the 0.9.8 branch. ok jlam@
2007-12-12Reset maintainer on his request.wiz1-2/+2
2006-11-22Fix path to docs in MESSAGE. This is PR #35096.reed2-4/+4
It was changed in Makefile revision 1.49 in July 2006. Bump PKGREVISION.
2006-07-12Moved documentation to share/doc/ntp4. Bumped PKGREVISION.rillig2-190/+189
2005-12-29Remove USE_PKGINSTALL from pkgsrc now that mk/install/pkginstall.mkjlam1-2/+1
automatically detects whether we want the pkginstall machinery to be used by the package Makefile.
2005-12-08Bumped the PKGREVISION of the packages that have been broken by the recentrillig1-2/+2
"pkglint --autofix" change.
2005-12-08Fixed PLIST quoting issue introduced by the recent "pkglint --autofix"rillig1-2/+2
change.
2005-12-05Ran "pkglint --autofix", which corrected some of the quoting issues inrillig1-2/+2
CONFIGURE_ARGS.
2005-12-05Fixed pkglint warnings. The warnings are mostly quoting issues, forrillig1-3/+3
example MAKE_ENV+=FOO=${BAR} is changed to MAKE_ENV+=FOO=${BAR:Q}. Some other changes are outlined in http://mail-index.netbsd.org/tech-pkg/2005/12/02/0034.html
2005-09-10Update nb6->nb7 for security fix: http://secunia.com/advisories/16602/adrianp3-3/+17
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-17 04:44:00 +0000