CVE-2015-5195: Improper Input Validation (CWE-20)
value: ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 7.5
Published: 2017-07-21T14:29Z
Repository: https://github.com/ntp-project/ntp
Language: C
Files changed: ChangeLog, m4/ntp_openssl.m4, ntpd/ntp_config.c, ntpd/ntp_util.c
Commit date: 2011-01-06 04:02:24 +0000
Commit message: [Bug 1773] openssl not detected during ./configure.
[Bug 1774] Segfaults if cryptostats enabled and built without OpenSSL.

Diff: diff --git a/ChangeLog b/ChangeLog
index 6896b34fd..e56e89998 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
+* [Bug 1773] openssl not detected during ./configure.
+* [Bug 1774] Segfaults if cryptostats enabled and built without OpenSSL.
 (4.2.7p111) 2011/01/05 Released by Harlan Stenn <stenn@ntp.org>
 * [Bug 1772] refclock_open() return value check wrong for ACTS.
 * Default --with-openssl-libdir and --with-openssl-incdir to the values
   from pkg-config, falling back on our usual search paths if pkg-config
   is not available or does not have openssl.pc on PKG_CONFIG_PATH.
diff --git a/m4/ntp_openssl.m4 b/m4/ntp_openssl.m4
index a57c55c03..192538964 100644
--- a/m4/ntp_openssl.m4
+++ b/m4/ntp_openssl.m4
@@ -29,27 +29,24 @@ case "$ans" in
  yes)
     case "$PKG_CONFIG" in
      '')
 	;;
      *)
-	pkgans=`$PKG_CONFIG --libs-only-L openssl | sed -e 's/^-L//'`
-	case "$pkgans" in
-	 '')
-	    # Look in:
-	    ans="/usr/lib /usr/lib/openssl /usr/sfw/lib"
-	    ans="$ans /usr/local/lib /usr/local/ssl/lib /lib"
-	    ;;
-	 *)
-	    ans="$pkgans"
-	    ;;
-	esac
+	pkgans="`$PKG_CONFIG --libs-only-L openssl | sed -e 's/^-L//'`" 2>/dev/null
+	test -f "${pkgans}/pkgconfig/openssl.pc" && ans="$pkgans"
 	;;
     esac
     ;;
  *) # Look where they said
     ;;
 esac
+case "$ans" in
+ yes)
+    # Look in:
+    ans="/usr/lib /usr/lib/openssl /usr/sfw/lib"
+    ans="$ans /usr/local/lib /usr/local/ssl/lib /lib"
+esac
 case "$ans" in
  no)
     ;;
  *) # Look for libcrypto.a and libssl.a:
     for i in $ans no
@@ -98,27 +95,24 @@ case "$ans" in
  yes) # look in:
     case "$PKG_CONFIG" in
      '')
 	;;
      *)
-	pkgans=`$PKG_CONFIG --cflags-only-I openssl | sed -e 's/^-I//'`
-	case "$pkgans" in
-	 '')
-	    # Look in:
-	    ans="/usr/include /usr/sfw/include /usr/local/include"
-	    ans="$ans /usr/local/ssl/include"
-	    ;;
-	 *)
-	    ans="$pkgans"
-	    ;;
-	esac
+	pkgans="`$PKG_CONFIG --cflags-only-I openssl | sed -e 's/^-I//'`" 2>/dev/null
+	test -f "${pkgans}/pkgconfig/openssl.pc" && ans="$pkgans"
 	;;
     esac
     ;;
  *) # Look where they said
     ;;
 esac
+case "$ans" in
+ yes)
+    # Look in:
+    ans="/usr/include /usr/sfw/include /usr/local/include"
+    ans="$ans /usr/local/ssl/include"
+esac
 case "$ans" in
  no)
     ;;
  *) # look for openssl/opensslconf.h:
     for i in $ans no
diff --git a/ntpd/ntp_config.c b/ntpd/ntp_config.c
index ca17b39ae..e6a61f083 100644
--- a/ntpd/ntp_config.c
+++ b/ntpd/ntp_config.c
@@ -2013,10 +2013,16 @@ config_monitor(
 	/* Turn on the specified statistics */
 	pfilegen_token = HEAD_PFIFO(ptree->stats_list);
 	for (; pfilegen_token != NULL; pfilegen_token = pfilegen_token->link) {
 		filegen_string = keyword(pfilegen_token->i);
 		filegen = filegen_get(filegen_string);
+		if (NULL == filegen) {
+			msyslog(LOG_ERR,
+				"stats %s unrecognized",
+				filegen_string);
+			continue;
+		}
 		DPRINTF(4, ("enabling filegen for %s statistics '%s%s'\n",
 			    filegen_string, filegen->prefix, 
 			    filegen->basename));
 		filegen->flag |= FGEN_FLAG_ENABLED;
 	}
@@ -2024,10 +2030,16 @@ config_monitor(
 	/* Configure the statistics with the options */
 	my_node = HEAD_PFIFO(ptree->filegen_opts);
 	for (; my_node != NULL; my_node = my_node->link) {
 		filegen_file = keyword(my_node->filegen_token);
 		filegen = filegen_get(filegen_file);
+		if (NULL == filegen) {
+			msyslog(LOG_ERR,
+				"filegen category '%s' unrecognized",
+				filegen_file);
+			continue;
+		}
 
 		/* Initialize the filegen variables to their pre-configuration states */
 		filegen_flag = filegen->flag;
 		filegen_type = filegen->type;
 
diff --git a/ntpd/ntp_util.c b/ntpd/ntp_util.c
index db8bf80f6..d63156d11 100644
--- a/ntpd/ntp_util.c
+++ b/ntpd/ntp_util.c
@@ -78,24 +78,20 @@ double	wander_threshold = 1e-7;	/* initial frequency threshold */
 
 #ifndef MAXPATHLEN
 # define MAXPATHLEN 256
 #endif
 
-#ifdef DEBUG_TIMING
-static FILEGEN timingstats;
-#endif
-#ifdef AUTOKEY
-static FILEGEN cryptostats;
-#endif	/* AUTOKEY */
 
 static	char statsdir[MAXPATHLEN] = NTP_VAR;
 static FILEGEN peerstats;
 static FILEGEN loopstats;
 static FILEGEN clockstats;
 static FILEGEN rawstats;
 static FILEGEN sysstats;
 static FILEGEN protostats;
+static FILEGEN cryptostats;
+static FILEGEN timingstats;
 
 /*
  * This controls whether stats are written to the fileset. Provided
  * so that ntpdc can turn off stats when the file system fills up. 
  */
@@ -171,16 +167,12 @@ init_util(void)
 	filegen_register(statsdir, "loopstats",	  &loopstats);
 	filegen_register(statsdir, "clockstats",  &clockstats);
 	filegen_register(statsdir, "rawstats",	  &rawstats);
 	filegen_register(statsdir, "sysstats",	  &sysstats);
 	filegen_register(statsdir, "protostats",  &protostats);
-#ifdef AUTOKEY
 	filegen_register(statsdir, "cryptostats", &cryptostats);
-#endif	/* AUTOKEY */
-#ifdef DEBUG_TIMING
 	filegen_register(statsdir, "timingstats", &timingstats);
-#endif	/* DEBUG_TIMING */
 	/*
 	 * register with libntp ntp_set_tod() to call us back
 	 * when time is stepped.
 	 */
 	step_callback = &ntpd_time_stepped;

Vulnerable code: 	pkgans=`$PKG_CONFIG --libs-only-L openssl | sed -e 's/^-L//'`
	case "$pkgans" in
	 '')
	    # Look in:
	    ans="/usr/lib /usr/lib/openssl /usr/sfw/lib"
	    ans="$ans /usr/local/lib /usr/local/ssl/lib /lib"
	    ;;
	 *)
	    ans="$pkgans"
	    ;;
	esac
	pkgans=`$PKG_CONFIG --cflags-only-I openssl | sed -e 's/^-I//'`
	case "$pkgans" in
	 '')
	    # Look in:
	    ans="/usr/include /usr/sfw/include /usr/local/include"
	    ans="$ans /usr/local/ssl/include"
	    ;;
	 *)
	    ans="$pkgans"
	    ;;
	esac
#ifdef DEBUG_TIMING
static FILEGEN timingstats;
#endif
#ifdef AUTOKEY
static FILEGEN cryptostats;
#endif	/* AUTOKEY */
#ifdef AUTOKEY
#endif	/* AUTOKEY */
#ifdef DEBUG_TIMING
#endif	/* DEBUG_TIMING */
Fixed code: * [Bug 1773] openssl not detected during ./configure.
* [Bug 1774] Segfaults if cryptostats enabled and built without OpenSSL.
	pkgans="`$PKG_CONFIG --libs-only-L openssl | sed -e 's/^-L//'`" 2>/dev/null
	test -f "${pkgans}/pkgconfig/openssl.pc" && ans="$pkgans"
case "$ans" in
 yes)
    # Look in:
    ans="/usr/lib /usr/lib/openssl /usr/sfw/lib"
    ans="$ans /usr/local/lib /usr/local/ssl/lib /lib"
esac
	pkgans="`$PKG_CONFIG --cflags-only-I openssl | sed -e 's/^-I//'`" 2>/dev/null
	test -f "${pkgans}/pkgconfig/openssl.pc" && ans="$pkgans"
case "$ans" in
 yes)
    # Look in:
    ans="/usr/include /usr/sfw/include /usr/local/include"
    ans="$ans /usr/local/ssl/include"
esac
		if (NULL == filegen) {
			msyslog(LOG_ERR,
				"stats %s unrecognized",
				filegen_string);
			continue;
		}
		if (NULL == filegen) {
			msyslog(LOG_ERR,
				"filegen category '%s' unrecognized",
				filegen_file);
			continue;
		}
static FILEGEN cryptostats;
static FILEGEN timingstats;