NTP.org has published a security advisory for six vulnerabilities resolved in ntpd (NTP daemon) that have been assigned four CVE IDs. In the worst case, some of these issues may allow remote unauthenticated attackers to execute code with the privileges of ntpd or cause a denial of service condition.

Vulnerable Products:

• Junos OS: Junos is confirmed to be vulnerable to one of the three buffer overflow issues covered by CVE-2014-9295 in all versions of Junos OS. CVE-2014-9295 is only exploitable on systems where NTP server is enabled within the [edit system ntp] hierarchy level.  Junos is not vulnerable to CVE-2014-9293, CVE-2014-9294, CVE-2014-9296, CVE-2014-9297, or CVE-2014-9298.

• NSM: All versions of NSM software, NSMXpress and NSM Series Appliances are vulnerable to these issues if the "Automatically Sync Time" option (under Time Server settings in the Web UI) is checked. This is off by default. NSM server software installed on generic Linux or Solaris servers may require NTP fixes from the respective server OS vendor.

• vGW: The vGW Series incorporates ntp 4.2.4p7-1.1-1 which is known to be vulnerable to all listed issues.

• Junos Space: Junos Space includes a vulnerable version of ntp which will be upgraded to ntp-4.2.2p1-18 in a future release.  Engineering is also working on a hot-patch to resolve this issue.

• ScreenOS and JUNOSe are  not vulnerable. The NTP modules in these products were designed and coded by Juniper Networks. They are not based on ntpd from NTP Project.

• Pulse Secure (IC/MAG/SA, etc.) products are not vulnerable. The Pulse Secure products do not include NTP server functionality and are therefore not vulnerable to these issues.

1. Transfer patch to the VIP Space Node
2. Log into the VIP node CLI
3. Extract the archive:
   tar -zxf glibc-ntp-hotpatch-vz.tgz


4. Change to the patch directory
   cd glibc-ntp-hotpatch-v1


5. Run the patch script
   sh patchme.sh

   Note: If the system is a cluster, it will prompt for login credentials for the other nodes, and patch all systems.

IMPORTANT

1. Upload the desired upgrade version of Space Platform to the system. [Do NOT start the upgrade]
2. Login to the VIP node
3. Change to the patch directory. [You may need to upload it again to the current node]
   cd glibc-ntp-hotpatch-v1
4. Run the command to patch the Space Upgrade script:
   sh fixupgrade.sh
5. Run the Junos Space Upgrade from the Web Interface.

1. SCP JSA10663_NSM_CentOS6.zip  ( SHA1 ) to NSM server /home/admin
2. Connect to NSM server CLI, become root using "sudo su -"
3. Change to to /home/admin: cd /home/admin
4. Unzip Package: unzip JSA10663 [juniper.net].zip
5. Cd to NTP: cd NTP
6. Upgrade RPMs: rpm -Uvh *.rpm
7. Reboot NSM appliance

Junos OS: Standard security best current practices (control plane firewall filters, edge filtering, access lists, etc.) will protect against any remote malicious attacks against NTP. Customers who have already applied the workaround described in JSA10613 [juniper.net] are already protected against any remote exploitation of these vulnerabilities. Refer to the Workaround section of JSA10613 [juniper.net] for specific applicable mitigation techniques.

NSM: Turning off NTP daemon by unchecking the "Automatically Sync Time" option (under Time Server settings in Web UI) should completely mitigate these issues.

vGW: Disable NTP services or limit access to NTP from trusted hosts.

2015-01-05: Initial release.
2015-01-08: Confirmed that CVE-2014-9294 and CVE-2014-9296 may also apply to Junos.
2015-01-15: Explicitly stated that JUNOSe is not vulnerable.
2015-01-21: Added vGW Series.
2015-02-03: Added explicit statement about CVE-2014-9293 not affecting Junos.
2015-02-24: Added Junos Space.
2015-02-24: Added fixed releases for Junos OS.
2015-02-26: Added Junos Space hot-patch info.
2015-02-27: Removed End-of-Engineering release 11.4 from Junos OS fixed release list.
2015-03-10: Confirmed that only CVE-2014-9295 affects Junos.
2015-03-23: Clarified Junos Space patch instructions.
2015-09-03: Added references to CVE-2014-9297 (formerly known as "NTP Bug 2671") and CVE-2014-9298 (formerly known as "NTP Bug 2672").
2015-12-09: Added NSM patch instructions.

• KB16613: Overview of the Juniper Networks SIRT Monthly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Security Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• NTP Project December 2014 NTP Security Vulnerability Announcement
• Junos Space hot-patch to resolve NTP and GHOST vulnerabilities