Summary
The SIMA2 Master Station features an NTP service based on ntpd, a reference implementation of the Network Time Protocol (NTP). Affected SIMA2 Master Stations with software version < V2.6 include an outdated version of ntpd which is affected by a large number of vulnerabilities
Details
Mitigation
1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2
2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:
- Allow NTP traffic to/from trusted NTP clients only
- Monitor the network for malicious NTP traffic going to/coming from the SIMA2
- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)
3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:
- Use trusted NTP servers only
- Allow NTP traffic to/from trusted NTP servers only
- Monitor the network for malicious NTP traffic targeting the SIMA2
- Filter malicious NTP traffic targeting the SIMA2
- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)
Remediation
Upgrade your SIMA2 to software version 2.6 or above. The NTP service of the SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.
Vulnerabilities 73
-
Medium 5.9
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronizati…
-
Medium 5.9
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit …
-
Medium 4.4
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory…
-
Unscored —
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and b…
-
Unscored —
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of servic…
-
Unscored —CVE-2014-9293 EPSS 13%
The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key…
-
Unscored —CVE-2014-9294 EPSS 13%
util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attacker…
-
Unscored —
Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via …
-
Unscored —CVE-2014-9296 EPSS 16%
The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authenti…
-
Unscored —
ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obta…
-
Unscored —
The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was great…
-
Unscored —
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause …
-
Unscored —
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause …
-
Unscored —
Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote att…
-
Unscored —
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause …
-
Unscored —
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configu…
-
Unscored —CVE-2015-7704 EPSS 11%
The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service …
-
Unscored —CVE-2015-7705 EPSS 12%
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified…
-
Unscored —CVE-2015-7849 EPSS 17%
Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated u…
-
Unscored —
ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of servic…
-
Unscored —
Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used…
-
Unscored —CVE-2015-7852 EPSS 12%
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) …
-
Unscored —CVE-2015-7853 EPSS 12%
The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attacke…
-
Unscored —CVE-2015-7854 EPSS 15%
Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows re…
-
Unscored —
The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause…
-
Unscored —
Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authe…
-
Unscored —
NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to co…
-
Unscored —
NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating pa…
-
Unscored —
The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, …
-
Unscored —
The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filte…
-
Unscored —
ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer d…
-
Unscored —
NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) vi…
-
Unscored —CVE-2015-7979 EPSS 12%
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server associat…
-
Unscored —
NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a pack…
-
Unscored —
ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecifi…
-
Unscored —
The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.
-
Unscored —
The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to caus…
-
Unscored —
An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec…
-
Unscored —
An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timest…
-
Unscored —
A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection a…
-
Unscored —
An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5f…
-
Unscored —
ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to pr…
-
Unscored —
NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service…
-
Unscored —
NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent aut…
-
Unscored —CVE-2016-2518 EPSS 15%
The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-…
-
Unscored —
ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by…
-
Unscored —CVE-2016-4953 EPSS 17%
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilizati…
-
Unscored —CVE-2016-4954 EPSS 13%
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial …
-
Unscored —
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-var…
-
Unscored —CVE-2016-4956 EPSS 16%
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and ti…
-
Unscored —CVE-2016-4957 EPSS 45%
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet.…
-
Unscored —CVE-2016-7426 EPSS 12%
NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations i…
-
Unscored —
The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a den…
-
Unscored —
ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the…
-
Unscored —
NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows rem…
-
Unscored —
NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp …
-
Unscored —
NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecifie…
-
Unscored —
The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a cra…
-
Unscored —CVE-2016-9310 EPSS 11%
The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via…
-
Unscored —CVE-2016-9311 EPSS 11%
ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NUL…
-
Unscored —
The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly…
-
Unscored —
Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authent…
-
Unscored —
Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remot…
-
Unscored —
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x be…
-
Unscored —
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon cras…
-
Unscored —
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a mal…
-
Unscored —
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or e…
-
Unscored —
The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out…
-
Unscored —CVE-2018-7183 EPSS 10%
Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute ar…
-
Unscored —
ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote att…
-
Unscored —
The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by…
-
Unscored —
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchro…
-
Unscored —CVE-2019-8936 Public exploit
NTP through 4.2.8p12 has a NULL Pointer Dereference.
Revision history
-
#1
Initial revision.
References
-
VDE-2022-032: AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service - HTML
https://certvde.com/en/advisories/VDE-2022-032/
-
AUMA PSIRT
https://www.auma.com/en_GB/service/psirt
-
CERT@VDE Security Advisories for AUMA Riester GmbH & Co. KG
https://certvde.com/en/advisories/vendor/auma/