Product Affected

These issues affect Junos OS 12.3, 12.3X48, 14.1X53, 15.1, 15.1X49, 16.1, 16.2, 17.1, 17.2, 17.3, 17.4, 18.1, 18.2, 18.3, 18.4, 19.1, 19.2. These issues affect Junos OS Evolved.
High
8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple NTP vulnerabilities have been resolved in Juniper Networks Junos OS and Junos OS Evolved by updating third party software where vulnerabilities were found during external security research.

These issues affect:

Juniper Networks Junos OS:

  • 12.3 versions prior to 12.3R12-S15 on EX Series;
  • 12.3X48 versions prior to 12.3X48-D95 on SRX Series;
  • 14.1X53 versions prior to 14.1X53-D53;
  • 15.1 versions prior to 15.1R7-S6 on EX Series;
  • 15.1X49 versions prior to 15.1X49-D190 on SRX Series;
  • 16.1 versions prior to 16.1R7-S6;
  • 16.2 versions prior to 16.2R3;
  • 17.1 versions prior to 17.1R2-S11, 17.1R3-S1;
  • 17.2 versions prior to 17.2R1-S9, 17.2R2-S8, 17.2R3-S3;
  • 17.3 versions prior to 17.3R2-S5, 17.3R3-S6;
  • 17.4 versions prior to 17.4R2-S7, 17.4R3;
  • 18.1 versions prior to 18.1R3-S8;
  • 18.2 versions prior to 18.2R2-S7, 18.2R3-S1;
  • 18.3 versions prior to 18.3R1-S5, 18.3R2-S2, 18.3R3;
  • 18.4 versions prior to 18.4R1-S4, 18.4R2-S1, 18.4R3;
  • 19.1 versions prior to 19.1R1-S3, 19.1R2;
  • 19.2 versions prior to 19.2R1-S1, 19.2R2.
Juniper Networks Junos OS Evolved
  • All versions prior to 20.1R1-EVO.

NTP must be operating on the device to be affected by these issues, for example, the following minimal configuration is necessary:

[set system ntp]

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were discovered during a external security research.

Important security issues resolved include:

CVECVSSSummary
CVE-2016-93106.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.
CVE-2013-52115.0 AV:N/AC:L/Au:N/C:N/I:N/A:PThe monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.
CVE-2016-90425.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.
CVE-2017-64517.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.
CVE-2017-64527.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Stack-based buffer overflow in the Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via an application path on the command line.
CVE-2017-64557.0 (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable.
CVE-2017-64588.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.
CVE-2017-64595.5 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes.
CVE-2017-64608.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
CVE-2017-64627.8 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
CVE-2017-64636.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
CVE-2017-64646.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.

 

Solution

The following software releases have been updated to resolve these specific issues:

Junos OS: 12.3R12-S15, 12.3X48-D95, 14.1X53-D53, 15.1R7-S6, 15.1X49-D190, 16.1R7-S6, 16.2R3, 17.1R2-S11, 17.1R3-S1, 17.2R1-S9, 17.2R2-S8, 17.2R3-S3, 17.3R2-S5, 17.3R3-S6, 17.4R2-S7, 17.4R3, 18.1R3-S8, 18.2R2-S7, 18.2R3-S1, 18.3R1-S5, 18.3R2-S2, 18.3R3, 18.4R1-S4, 18.4R2-S1, 18.4R3, 19.1R1-S3, 19.1R2, 19.2R1-S1, 19.2R2, 19.3R1 and all subsequent releases.

Junos OS Evolved: 20.1R1-EVO, and subsequent releases.

After upgrading to a resolved release, the mitigations listed in the following advisories also need to be applied:

Then, the CLI must be configured using the ntp restrict command:

set system ntp restrict
mask <mask_addr> noquery

commit

Note 1: With the above configuration all masked source addresses (source_address & mask_addr) which matches with (address & mask_addr) are restricted to query ntpq/ntpdc to ntp server.

Note 2: The restriction of subnets is only available from Junos OS 20.1R1, and subsequent releases, and Junos OS Evolved 20.2R1-EVO, and subsequent releases.

An Example Configuration which allows all the hosts having address 192.168.0.<0-255> being unable to send ntpq/ntpdc query to ntp server from Junos OS 20.1R1, and onward, and Junos OS Evolved 20.2R1-EVO, and onward:

set system ntp restrict 192.168.0.1 mask 255.255.255.0 noquery

Note 3: The noquery option is a hidden command in all releases prior to Junos OS 20.1R1. The command may not persist across reboots, so care must be taken to ensure that it is written to the ntp configuration file. Contact Juniper Networks Technical Assistance Center (JTAC) for guided assistance if necessary.

If any of the above NTP mitigations are not in place, there is still the possibility of exploitability.

This issue is being tracked as PR 1269141, 1446493  and  1446497 . 

Software releases or updates are available for download at https://support.juniper.net/support/downloads/

Workaround

Use firewall filters to block NTP mode 6 query packets.
Set system ntp restrict to block local ntpq <-> ntpd query responses. i.e. disallow 127.0.0.1 and -6 ::1 if allowed in addition to remote hosts.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2021-04-14: Initial Publication.
2023-05-02: Added additional CVEs. Updated Severity to High. Updated CVSS Score to 8.8. Added PR 1269141 to tracking. Included additional workaround guidance to set system ntp restrict to block local ntpq <-> ntpd query responses thus blocking all query responses from any location. i.e. disallow 127.0.0.1 and -6 ::1 if allowed in addition to remote hosts.

Related Information