Potential issue in NTP -A option

[Kurt Seifried <kseifried () redhat com>]

Miroslav Lichvar noticed that the -A option (disable auth) in ntpd:

However the documentation seems to conflict slightly, in man ntpdc we have:

==========
disable [ flag ] [ ... ]
These commands operate in the same way as the enable and disable
configuration file commands of ntpd. Following is a description of the
flags. Note that only the auth, bclient, monitor, pll, pps and stats
flags can be set by ntpdc; the pll_kernel and pps_kernel flags are
read-only.

auth
Enables the server to synchronize with unconfigured peers only if the
peer has been correctly authenticated using a trusted key and key
identifier. The default for this flag is enable.
==========

and in man ntpd we have:
==========
       -A      Do  not require cryptographic authentication for
broadcast client, multicast client and symmetric passive associations.
This is the same operation as the dis‐
               able auth command and almost never a good idea.
==========

In testing Miroslav found that -A disables all authentication checks
including those used for mode 7 control messages (e.g. the stuff ntpdc
sends).

I contacted Harlan to see if he could shed any light on this, he agrees
the docs should be updated, and both himself and I are not 100% sure
about assigning a CVE here. I can see arguments going both ways, but
ultimately I think it's enough of a gray area that it's probably best to
let Mitre weight in. The main argument against would be "-A disables
auth, don't do that" and the main argument for would be "the docs make
it sound semi safe, so like an advertised security feature that doesn't
work, that qualifies it for a CVE".

This can also be patched in source to force auth to be used, but then,
if -A is truly intended to disable all auth that would break that
feature (which is arguably dangerous, but also useful, much like debug
and information disclosure issues).

-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Attachment: signature.asc
Description: OpenPGP digital signature