Synology-SA-18:13 NTP

Abstract

These vulnerabilities allow remote attackers to conduct association attacks via a susceptible version of Synology DiskStation Manager (DSM), Synology Router Manager (SRM), Virtual DSM, SkyNAS or VS960HD.

Affected Products

Mitigation

None

Detail

• CVE-2018-7185

  • Severity: Low
  • CVSS3 Base Score: 3.1
  • CVSS3 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association.

• CVE-2018-7184

  • Severity: Low
  • CVSS3 Base Score: 3.1
  • CVSS3 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
  • ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.

• CVE-2018-7170

  • Severity: Low
  • CVSS3 Base Score: 3.1
  • CVSS3 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
  • ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.

• CVE-2018-7183

  • Severity: Moderate
  • CVSS3 Base Score: 5.0
  • CVSS3 Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
  • Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.

• CVE-2018-7182

  • Severity: Moderate
  • CVSS3 Base Score: 5.3
  • CVSS3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
  • The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.

• CVE-2016-1549

  • Severity: Moderate
  • CVSS3 Base Score: 5.3
  • CVSS3 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
  • A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim's clock.

Reference

• February 2018 ntp-4.2.8p11 NTP Security Vulnerability Announcement
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7170
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7182
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7183
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7184
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7185

Revision