The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-470:02 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's     time with another reference time source. This package includes ntpd     (a daemon which continuously adjusts system time) and utilities used     to query and configure the ntpd daemon.
    Perl scripts ntp-wait and ntptrace are in the ntp-perl package and     the ntpdate program is in the ntpdate package. The documentation is     in the ntp-doc package.
    Security issues fixed with this release:
    CVE-2015-5194
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-5195
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-5219
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7691
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7692
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7701
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7702
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7703
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7852
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7977
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2015-7978
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.(CVE-2015-5194)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by     the statistics or filegen configuration     command.(CVE-2015-5195)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-5196)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet.(CVE-2015-5219)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7691)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7692)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.(CVE-2015-7701)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7702)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-7703)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash.(CVE-2015-7852)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client     (A).(CVE-2015-7974)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to     crash ntpd.(CVE-2015-7977)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash     ntpd.(CVE-2015-7978)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with     bad authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of     time.(CVE-2015-7979)

  - A flaw was found in the way the ntpq client processed     certain incoming packets in a loop in the getresponse()     function. A remote attacker could potentially use this     flaw to crash an ntpq client instance.(CVE-2015-8158)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A remote     attacker could use a specially crafted NTP packet to     crash ntpd. (CVE-2015-7691, CVE-2015-7692,     CVE-2015-7702)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory. (CVE-2015-7701)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash. (CVE-2015-7852)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to crash     ntpd. (CVE-2015-7977)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash ntpd.
    (CVE-2015-7978)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with bad     authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of time.
    (CVE-2015-7979)

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands. (CVE-2015-5194)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled during     compilation (e.g. timingstats) was referenced by the     statistics or filegen configuration command.
    (CVE-2015-5195)

  - It was found that NTP's :config command could be used to     set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals). (CVE-2015-5196, CVE-2015-7703)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet. (CVE-2015-5219)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client (A).
    (CVE-2015-7974)

  - A flaw was found in the way the ntpq client processed     certain incoming packets in a loop in the getresponse()     function. A remote attacker could potentially use this     flaw to crash an ntpq client instance. (CVE-2015-8158)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

Additional Changes :

This update for ntp fixes the following issues :

ntp was updated to 4.2.8p9.

Security issues fixed :

  - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6     unauthenticated trap information disclosure and DDoS     vector.

  - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay     Prevention DoS.

  - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval     Enforcement DoS.

  - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero     Origin Timestamp Bypass.

  - CVE-2016-7434, bsc#1011398: NULL pointer dereference in
    _IO_str_init_static_internal().

  - CVE-2016-7429, bsc#1011404: Interface selection attack.

  - CVE-2016-7426, bsc#1011406: Client rate limiting and     server responses.

  - CVE-2016-7433, bsc#1011411: Reboot sync calculation     problem.

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).

Non-security issues fixed :

  - Fix a spurious error message.

  - Other bugfixes, see     /usr/share/doc/packages/ntp/ChangeLog.

  - Fix a regression in 'trap' (bsc#981252).

  - Reduce the number of netlink groups to listen on for     changes to the local network setup (bsc#992606).

  - Fix segfault in 'sntp -a' (bsc#1009434).

  - Silence an OpenSSL version warning (bsc#992038).

  - Make the resolver task change user and group IDs to the     same values as the main task. (bsc#988028)

  - Simplify ntpd's search for its own executable to prevent     AppArmor warnings (bsc#956365).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

ID	名稱	產品	系列	已發布	已更新	嚴重性
290036	MiracleLinux 4 : ntp-4.2.6p5-10.0.1.AXS4 (AXSA:2016-470:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
99822	EulerOS 2.0 SP1 : ntp (EulerOS-SA-2016-1060)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	high
95850	Scientific Linux Security Update : ntp on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/14	high
96173	openSUSE Security Update : ntp (openSUSE-2016-1525)	Nessus	SuSE Local Security Checks	2016/12/29	2026/1/7	medium

偵測

搜尋 Plugin

high

high

high

medium