(LiveHacking.Com) – Apple has released a patch for OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X Yosemite v10.10.1 to update the included NTP server to fix the recently disclosed vulnerabilities. The standard, open source Network Time Protocol (NTP) daemon (ntpd) contains multiple vulnerabilities which were publicly disclosed a few days ago. The vulnerabilities not only affect OS X, but also other Unix-type operating systems like Linux and FreeBSD.
ntpd version 4.2.7 and before, have several to buffer overflow issues. If exploited they could allow malicious code to be executed. Also, ntp-keygen prior to version 4.2.7p230 has been found to use a non-cryptographic random number generator when generating symmetric keys. These vulnerabilities affect ntpd acting as a server or client.
The full list of vulnerabilities is as follow:
- CWE-332 – If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated.
- CWE-338 – ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys.
- CWE-121 – A remote unauthenticated attacker may craft special packets that trigger buffer overflows in the ntpd functions crypto_recv() (when using autokey authentication), ctl_putdata(), and configure(). The resulting buffer overflows may be exploited to allow arbitrary malicious code to be executed with the privilege of thentpd process.
- CWE-389 – A section of code in ntpd handling a rare error is missing a return statement, therefore processing did not stop when the error was encountered. This situation may be exploitable by an attacker.
Apple’s release notes state that “a remote attacker may be able to execute arbitrary code” due to the vulnerabilities. The security bulletin goes on to say that “Several issues existed in ntpd that would have allowed an attacker to trigger buffer overflows. These issues were addressed through improved error checking.”