[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <E1YsyCw-000A69-3u@stenn.ntp.org>
Date: Thu, 14 May 2015 18:50:10 +0000
From: Harlan Stenn <stenn@....org>
To: cve-assign@...re.org
cc: kseifried@...hat.com, oss-security@...ts.openwall.com, stenn@....org,
sgraves@...ime.org
Subject: Re: Potential issue in NTP -A option
cve-assign@...re.org writes:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > the documentation seems to conflict slightly
>
> We do not feel that a CVE is required; however, Harlan can choose to
> have a CVE ID if the undocumented risky behavior is going to be
> announced as a vulnerability.
We're not going to announce this as a vulnerability.
I'm with Kurt on this one - from our POV '-A' means "disable
authentication checks" and I'd bet that Prof. Mills wrote the
documentation that says ... "this is almost never a good idea."
> More specifically, it appears that mode 7 itself is, in some sense,
> deprecated (e.g., "mode7 ... Enables processing of NTP mode 7
> implementation-specific requests which are used by the deprecated
> ntpdc program" on the
> http://www.eecis.udel.edu/~mills/ntp/html/miscopt.html page and
> "functionally deprecating ntpdc" on the
> http://support.ntp.org/bin/view/Main/SoftwareDownloads page). If so,
> then we do not feel that there is a requirement for the documentation
> to precisely specify the effect of a command-line option on a
> deprecated feature. The -A documentation doesn't directly make a false
> statement about authentication within mode 7; it simply does not
> discuss mode 7.
>
> If mode 7 itself isn't deprecated, and there is a supported use case
> in which the user may choose to enable both mode 7 and the -A option,
> then announcing the behavior/documentation mismatch as a vulnerability
> is probably more useful.
Mode 7 is for "vendor-specific" control operations, and there is no
requirement in the protocol for any data structure in the packets.
There is also no requirement for *any* use of mode 7. We noticed enough
difficulties trying to use mode 7 that we shifted everything to mode 6
(ntpq).
To be clear, this issue (-A) is about a discrepancy between the
documentation and the behavior of older, EOL'd versions of the reference
implementation of NTP. I'll be looking to add clarifying language to
our on-line set of documentation for older, EOL'd NTP releases, but
that's all.
I haven't seen *any* other NTP implementation that provides either mode
6 or mode 7 support.
So I'm planning to make an announcement along the lines of "-A means
'disable authentication' and we've documented that this is almost never
a good idea. If you have done X in an environment that allows Y, that
will allow bad guys to do Z. That's a real problem and is an obvious
case of why using -A is generally a Bad Idea."
Never put salt in your eyes: https://www.youtube.com/watch?v=_83MEuLoz9Y
--
Harlan Stenn <stenn@....org>
http://networktimefoundation.org - be a member!
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
