summaryrefslogtreecommitdiffstats
path: root/meta-networking/recipes-support/ntp
diff options
context:
space:
mode:
authorZhang Xiao <xiao.zhang@windriver.com>2014-08-14 11:14:46 +0800
committerMartin Jansa <Martin.Jansa@gmail.com>2014-08-21 21:35:05 +0200
commit622ad1538bd931e3bda6c8a9c4cd879db454d15d (patch)
tree9e543f3135672dedc45062f84c69de6d44026756 /meta-networking/recipes-support/ntp
parent55ebea4bb0909e936ad89c17abfeb3549937aefa (diff)
downloadmeta-openembedded-622ad1538bd931e3bda6c8a9c4cd879db454d15d.tar.gz
ntp: fix CVE-2013-5211
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Diffstat (limited to 'meta-networking/recipes-support/ntp')
-rw-r--r--meta-networking/recipes-support/ntp/files/CVE-2013-5211.patch112
-rw-r--r--meta-networking/recipes-support/ntp/ntp.inc1
2 files changed, 113 insertions, 0 deletions
diff --git a/meta-networking/recipes-support/ntp/files/CVE-2013-5211.patch b/meta-networking/recipes-support/ntp/files/CVE-2013-5211.patch
new file mode 100644
index 000000000..ddcb044e6
--- /dev/null
+++ b/meta-networking/recipes-support/ntp/files/CVE-2013-5211.patch
@@ -0,0 +1,112 @@
1ntp: fix CVE-2013-5211
2
3Upstream-status: Backport
4
5The monlist feature in ntp_request.c in ntpd in NTP before
64.2.7p26 allows remote attackers to cause a denial of service
7(traffic amplification) via forged (1) REQ_MON_GETLIST or
8(2) REQ_MON_GETLIST_1 requests, as exploited in the wild
9in December 2013.
10
11Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com>
12
13--- a/ntpd/ntp_request.c
14+++ b/ntpd/ntp_request.c
15@@ -1912,44 +1912,11 @@ mon_getlist_0(
16 struct req_pkt *inpkt
17 )
18 {
19- register struct info_monitor *im;
20- register struct mon_data *md;
21- extern struct mon_data mon_mru_list;
22- extern int mon_enabled;
23-
24 #ifdef DEBUG
25 if (debug > 2)
26 printf("wants monitor 0 list\n");
27 #endif
28- if (!mon_enabled) {
29- req_ack(srcadr, inter, inpkt, INFO_ERR_NODATA);
30- return;
31- }
32- im = (struct info_monitor *)prepare_pkt(srcadr, inter, inpkt,
33- v6sizeof(struct info_monitor));
34- for (md = mon_mru_list.mru_next; md != &mon_mru_list && im != 0;
35- md = md->mru_next) {
36- im->lasttime = htonl((u_int32)((current_time -
37- md->firsttime) / md->count));
38- im->firsttime = htonl((u_int32)(current_time - md->lasttime));
39- im->restr = htonl((u_int32)md->flags);
40- im->count = htonl((u_int32)(md->count));
41- if (IS_IPV6(&md->rmtadr)) {
42- if (!client_v6_capable)
43- continue;
44- im->addr6 = SOCK_ADDR6(&md->rmtadr);
45- im->v6_flag = 1;
46- } else {
47- im->addr = NSRCADR(&md->rmtadr);
48- if (client_v6_capable)
49- im->v6_flag = 0;
50- }
51- im->port = md->rmtport;
52- im->mode = md->mode;
53- im->version = md->version;
54- im = (struct info_monitor *)more_pkt();
55- }
56- flush_pkt();
57+ req_ack(srcadr, inter, inpkt, INFO_ERR_NODATA);
58 }
59
60 /*
61@@ -1962,50 +1929,7 @@ mon_getlist_1(
62 struct req_pkt *inpkt
63 )
64 {
65- register struct info_monitor_1 *im;
66- register struct mon_data *md;
67- extern struct mon_data mon_mru_list;
68- extern int mon_enabled;
69-
70- if (!mon_enabled) {
71- req_ack(srcadr, inter, inpkt, INFO_ERR_NODATA);
72- return;
73- }
74- im = (struct info_monitor_1 *)prepare_pkt(srcadr, inter, inpkt,
75- v6sizeof(struct info_monitor_1));
76- for (md = mon_mru_list.mru_next; md != &mon_mru_list && im != 0;
77- md = md->mru_next) {
78- im->lasttime = htonl((u_int32)((current_time -
79- md->firsttime) / md->count));
80- im->firsttime = htonl((u_int32)(current_time - md->lasttime));
81- im->restr = htonl((u_int32)md->flags);
82- im->count = htonl((u_int32)md->count);
83- if (IS_IPV6(&md->rmtadr)) {
84- if (!client_v6_capable)
85- continue;
86- im->addr6 = SOCK_ADDR6(&md->rmtadr);
87- im->v6_flag = 1;
88- im->daddr6 = SOCK_ADDR6(&md->interface->sin);
89- } else {
90- im->addr = NSRCADR(&md->rmtadr);
91- if (client_v6_capable)
92- im->v6_flag = 0;
93- if (MDF_BCAST == md->cast_flags)
94- im->daddr = NSRCADR(&md->interface->bcast);
95- else if (md->cast_flags) {
96- im->daddr = NSRCADR(&md->interface->sin);
97- if (!im->daddr)
98- im->daddr = NSRCADR(&md->interface->bcast);
99- } else
100- im->daddr = 4;
101- }
102- im->flags = htonl(md->cast_flags);
103- im->port = md->rmtport;
104- im->mode = md->mode;
105- im->version = md->version;
106- im = (struct info_monitor_1 *)more_pkt();
107- }
108- flush_pkt();
109+ req_ack(srcadr, inter, inpkt, INFO_ERR_NODATA);
110 }
111
112 /*
diff --git a/meta-networking/recipes-support/ntp/ntp.inc b/meta-networking/recipes-support/ntp/ntp.inc
index 2c8f48864..b63f202fe 100644
--- a/meta-networking/recipes-support/ntp/ntp.inc
+++ b/meta-networking/recipes-support/ntp/ntp.inc
@@ -24,6 +24,7 @@ SRC_URI = "http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-${PV}.tar.g
24 file://sntp \ 24 file://sntp \
25 file://ntpd.list \ 25 file://ntpd.list \
26 file://ntp-disable-debugging.patch \ 26 file://ntp-disable-debugging.patch \
27 file://CVE-2013-5211.patch \
27" 28"
28 29
29inherit autotools update-rc.d useradd systemd 30inherit autotools update-rc.d useradd systemd
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-12 15:27:54 +0000