An exploitable vulnerability exists in the message authentication functionality of Network Time Protocol libntp. An attacker can send a series of crafted messages to attempt to recover the message digest key.
ntp 4.2.8p4 NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92
CVSSv2: 4.0 - AV:N/AC:H/Au:N/C:P/I:P/A:N CVSSv3: 4.8 - AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
The MD5authdecrypt() function in libntp/a_md5encrypt.c is used to verify the authenticity of a received packet that uses keyed-hash symmetric authentication, where the hash algorithm used is specified by an argument passed to the function.This functionality is implemented by comparing a received message digest to one computed by using the input packet and the key pointed to by the input packet’s key id field.
The comparison is performed with memcmp() or the byte specific version bcmp() depending on the NTP version being examined. Depending on how these functions are implemented, a timing attack might be possible. Certain memory comparison function implementations return as soon as a mismatch is found between the compared memory to optimize execution time. As a result, valid memory comparisons will take more time as execution proceeds.
If the memory comparison function compares a small number of bytes at a time, then an attacker could brute-force the message digest by guessing values and determining when the comparison function runs for a longer amount of time. bcmp() is especially susceptible to this type of attack because it is a byte-comparison function.
Instead, it is recommended that a constant time memory comparison function be used. Specifically, the CRYPTO_memcmp() function that is provided by openssl is the recommended replacement.
For more information, please see: https://wiki.openssl.org/index.php/EVP_Signing_and_Verifying#Verifying_2 http://rdist.root.org/2010/08/05/optimized-memcmp-leaks-useful-timing-differences/
2016-02-11 (approx) - CERT reports to NTP
2016-04-26 - Public disclosure
This vulnerability was discovered by Matthew Van Gundy and Stephen Gray of Cisco ASIG. This defect was independently discovered and reported to the NTP Project by Loganaden Velvindron of Hackers.mu as Bug 2879.