-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1
=============================================================================

FreeBSD-SA-09:11.ntpd                                       Security Advisory

                                                          The FreeBSD Project
Topic:          ntpd stack-based buffer-overflow vulnerability
Category:       contrib

Module:         ntpd

Announced:      2009-06-10

Credits:        Chris Ries

Affects:        All supported versions of FreeBSD.

Corrected:      2009-06-10 10:31:11 UTC (RELENG_7, 7.2-STABLE)

                2009-06-10 10:31:11 UTC (RELENG_7_2, 7.2-RELEASE-p1)

                2009-06-10 10:31:11 UTC (RELENG_7_1, 7.1-RELEASE-p6)

                2009-06-10 10:31:11 UTC (RELENG_6, 6.4-STABLE)

                2009-06-10 10:31:11 UTC (RELENG_6_4, 6.4-RELEASE-p5)

                2009-06-10 10:31:11 UTC (RELENG_6_3, 6.3-RELEASE-p11)

CVE Name:       CVE-2009-1252
For general information regarding FreeBSD Security Advisories,

including descriptions of the fields above, security branches, and the

following sections, please visit .
I.   Background
The ntpd(8) daemon is an implementation of the Network Time Protocol (NTP)

used to synchronize the time of a computer system to a reference time

source.
Autokey is a security model for authenticating Network Time Protocol

(NTP) servers to clients, using public key cryptography.
II.  Problem Description
The ntpd(8) daemon is prone to a stack-based buffer-overflow when it is

configured to use the 'autokey' security model.
III. Impact
This issue could be exploited to execute arbitrary code in the context of

the service daemon, or crash the service daemon, causing denial-of-service

conditions.
IV.  Workaround
Use IP based restrictions in ntpd(8) itself or in IP firewalls to

restrict which systems can send NTP packets to ntpd(8).
Note that systems will only be affected if they have the "autokey" option

set in /etc/ntp.conf; FreeBSD does not ship with a default ntp.conf file,

so will not be affected unless this option has been explicitly enabled by

the system administrator.
V.   Solution
Perform one of the following:
1) Upgrade your vulnerable system to 6-STABLE, or 7-STABLE, or to the

RELENG_7_2, RELENG_7_1, RELENG_6_4, or RELENG_6_3 security branch

dated after the correction date.
2) To patch your present system:
The following patches have been verified to apply to FreeBSD 6.3, 6.4,

7.1, and 7.2 systems.
a) Download the relevant patch from the location below, and verify the

detached PGP signature using your PGP utility.
[FreeBSD 6.3]

# fetch http://security.FreeBSD.org/patches/SA-09:11/ntpd63.patch

# fetch http://security.FreeBSD.org/patches/SA-09:11/ntpd63.patch.asc
[FreeBSD 6.4 and 7.x]

# fetch http://security.FreeBSD.org/patches/SA-09:11/ntpd.patch

# fetch http://security.FreeBSD.org/patches/SA-09:11/ntpd.patch.asc
b) Execute the following commands as root:
# cd /usr/src

# patch < /path/to/patch

# cd /usr/src/usr.sbin/ntp/ntpd

# make obj && make depend && make && make install

# /etc/rc.d/ntpd restart
VI.  Correction details
The following list contains the revision numbers of each file that was

corrected in FreeBSD.
CVS:
Branch                                                           Revision

  Path

- -------------------------------------------------------------------------

RELENG_6

  src/contrib/ntp/ntpd/ntp_crypto.c                           1.1.1.3.8.3

RELENG_6_4

  src/UPDATING                                             1.416.2.40.2.9

  src/sys/conf/newvers.sh                                  1.69.2.18.2.11

  src/contrib/ntp/ntpd/ntp_crypto.c                       1.1.1.3.8.1.2.2

RELENG_6_3

  src/UPDATING                                            1.416.2.37.2.16

  src/sys/conf/newvers.sh                                  1.69.2.15.2.15

  src/contrib/ntp/ntpd/ntp_crypto.c                          1.1.1.3.20.2

RELENG_7

  src/contrib/ntp/ntpd/ntp_crypto.c                          1.1.1.3.18.3

RELENG_7_2

  src/UPDATING                                             1.507.2.23.2.4

  src/sys/conf/newvers.sh                                   1.72.2.11.2.5

  src/contrib/ntp/ntpd/ntp_crypto.c                      1.1.1.3.18.2.2.1

RELENG_7_1

  src/UPDATING                                             1.507.2.13.2.9

  src/sys/conf/newvers.sh                                   1.72.2.9.2.10

  src/contrib/ntp/ntpd/ntp_crypto.c                      1.1.1.3.18.1.2.2

- -------------------------------------------------------------------------
Subversion:
Branch/path                                                      Revision

- -------------------------------------------------------------------------

stable/6/                                                         r193893

releng/6.4/                                                       r193893

releng/6.3/                                                       r193893

stable/7/                                                         r193893

releng/7.2/                                                       r193893

releng/7.1/                                                       r193893

- -------------------------------------------------------------------------
VII. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252
The latest revision of this advisory is available at

http://security.FreeBSD.org/advisories/FreeBSD-SA-09:11.ntpd.asc

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (FreeBSD)
iEYEARECAAYFAkovjOwACgkQFdaIBMps37KRpwCfaQF9q8KhElv6LqgFv3DX2h9c

hbEAn2Q0X8Qv8r5OySnhlAw2pMxlxkXK

=Mh2u

-----END PGP SIGNATURE-----

_______________________________________________

freebsd-security-notifications@freebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-security-notifications

To unsubscribe, send any mail to "freebsd-security-notifications-unsubscribe@freebsd.org"