This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050) :

  - CVE-2017-6464: Denial of Service via Malformed Config

  - CVE-2017-6462: Buffer Overflow in DPTS Clock

  - CVE-2017-6463: Authenticated DoS via Malicious Config     Option

  - CVE-2017-6458: Potential Overflows in ctl_put()     functions

  - CVE-2017-6451: Improper use of snprintf() in     mx4200_send()

  - CVE-2017-6460: Buffer Overflow in ntpq when fetching     reslist

  - CVE-2016-9042: 0rigin (zero origin) DoS.

  - ntpq_stripquotes() returns incorrect Value

  - ereallocarray()/eallocarray() underused

  - Copious amounts of Unused Code

  - Off-by-one in Oncore GPS Receiver

  - Makefile does not enforce Security Flags

Bugfixes :

  - Remove spurious log messages (bsc#1014172).

  - clang scan-build findings

  - Support for openssl-1.1.0 without compatibility modes

  - Bugfix 3072 breaks multicastclient

  - forking async worker: interrupted pipe I/O

  - (...) time_pps_create: Exec format error

  - Incorrect Logic for Peer Event Limiting

  - Change the process name of forked DNS worker

  - Trap Configuration Fail

  - Nothing happens if minsane < maxclock < minclock

  - allow -4/-6 on restrict line with mask

  - out-of-bound pointers in ctl_putsys and decode_bitflags

  - Move ntp-kod to /var/lib/ntp, because /var/db is not a     standard directory and causes problems for transactional     updates.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - Multiple stack-based buffer overflow conditions exist in     various wrappers around the ctl_putdata() function     within file ntpd/ntp_control.c due to improper     validation of certain input from the ntp.conf file.
    An unauthenticated, remote attacker can exploit these,     by convincing a user into deploying a specially     crafted ntp.conf file, to cause a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2017-6458)

  - A stack-based buffer overflow condition exists in the     datum_pts_receive() function within file     ntpd/refclock_datum.c when handling handling packets     from the '/dev/datum' device due to improper validation     of certain input. A local attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-6462)

  - A denial of service vulnerability exists when handling     configuration directives. An authenticated, remote     attacker can exploit this, via a malformed 'mode'     configuration directive, to crash the ntpd daemon.
    (CVE-2017-6464)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ntpq in NTP before 4.2.8p7 allows remote attackers to     obtain origin timestamps and then impersonate peers via     unspecified vectors.i1/4^CVE-2015-8139i1/4%0

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7     is enabled, allows remote attackers to cause a denial     of service (ntpd abort) by using the same IP address     multiple times in an unconfig     directive.i1/4^CVE-2016-2516i1/4%0

  - The process_packet function in ntp_proto.c in ntpd in     NTP 4.x before 4.2.8p8 allows remote attackers to cause     a denial of service (peer-variable modification) by     sending spoofed packets from many source IP addresses     in a certain scenario, as demonstrated by triggering an     incorrect leap indication.i1/4^CVE-2016-4954i1/4%0

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is     enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage)     by sending (1) a spoofed crypto-NAK packet or (2) a     packet with an incorrect MAC value at a certain     time.i1/4^CVE-2016-4955i1/4%0

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers     to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast     packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548.i1/4^CVE-2016-4956i1/4%0

  - Buffer overflow in the legacy Datum Programmable Time     Server (DPTS) refclock driver in NTP before 4.2.8p10     and 4.3.x before 4.3.94 allows local users to have     unspecified impact via a crafted /dev/datum     device.i1/4^CVE-2017-6462i1/4%0

  - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows     remote authenticated users to cause a denial of service     (daemon crash) via an invalid setting in a :config     directive, related to the unpeer     option.i1/4^CVE-2017-6463i1/4%0

  - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows     remote attackers to cause a denial of service (ntpd     crash) via a malformed mode configuration     directive.i1/4^CVE-2017-6464i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0855 advisory.

  - ntp: Buffer Overflow in DPTS Clock (CVE-2017-6462)

  - ntp: Authenticated DoS via Malicious Config Option (CVE-2017-6463)

  - ntp: Denial of Service via Malformed Config (CVE-2017-6464)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of the remote NTP server is 4.x prior to 4.2.8p10. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     receive() function within file ntpd/ntp_proto.c due to     the expected origin timestamp being cleared when a     packet with a zero origin timestamp is received. An     unauthenticated, remote attacker can exploit this issue,     via specially crafted network packets, to reset the     expected origin timestamp for a target peer, resulting     in legitimate replies being dropped. (CVE-2016-9042)

  - An out-of-bounds write error exists in the mx4200_send()     function within file ntpd/refclock_mx4200.c due to     improper handling of the return value of the snprintf()     and vsnprintf() functions. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or possibly the execution of arbitrary code.
    However, neither the researcher nor vendor could find     any exploitable code path. (CVE-2017-6451)

  - A stack-based buffer overflow condition exists in the     addSourceToRegistry() function within file     ports/winnt/instsrv/instsrv.c due to improper validation     of certain input when adding registry keys. A local     attacker can exploit this to execute arbitrary code.
    (CVE-2017-6452)

  - A flaw exists due to dynamic link library (DLL) files     being preloaded when they are defined in the inherited     environment variable 'PPSAPI_DLLS'. A local attacker can     exploit this, via specially crafted DLL files, to     execute arbitrary code with elevated privileges.
    (CVE-2017-6455)

  - Multiple stack-based buffer overflow conditions exist in     various wrappers around the ctl_putdata() function     within file ntpd/ntp_control.c due to improper     validation of certain input from the ntp.conf file.
    An unauthenticated, remote attacker can exploit these,     by convincing a user into deploying a specially     crafted ntp.conf file, to cause a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2017-6458)

  - A flaw exists in the addKeysToRegistry() function within     file ports/winnt/instsrv/instsrv.c when running the     Windows installer due to improper termination of strings     used for adding registry keys, which may cause malformed     registry entries to be created. A local attacker can     exploit this issue to possibly disclose sensitive memory     contents. (CVE-2017-6459)

  - A stack-based buffer overflow condition exists in the     reslist() function within file ntpq/ntpq-subs.c when     handling server responses due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this, by convincing a user to connect to a     malicious NTP server and by using a specially crafted     server response, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2017-6460)

  - A stack-based buffer overflow condition exists in the     datum_pts_receive() function within file     ntpd/refclock_datum.c when handling handling packets     from the '/dev/datum' device due to improper validation     of certain input. A local attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-6462)

  - A denial of service vulnerability exists within file     ntpd/ntp_config.c when handling 'unpeer' configuration     options. An authenticated, remote attacker can exploit     this issue, via an 'unpeer' option value of '0', to     crash the ntpd daemon. (CVE-2017-6463)

  - A denial of service vulnerability exists when handling     configuration directives. An authenticated, remote     attacker can exploit this, via a malformed 'mode'     configuration directive, to crash the ntpd daemon.
    (CVE-2017-6464)

  - A flaw exists in the ntpq_stripquotes() function within     file ntpq/libntpq.c due to the function returning an     incorrect value. An unauthenticated, remote attacker can     possibly exploit this to have an unspecified impact.

  - An off-by-one overflow condition exists in the     oncore_receive() function in file ntpd/refclock_oncore.c     that possibly allows an unauthenticated, remote attacker     to have an unspecified impact.

  - A flaw exists due to certain code locations not invoking     the appropriate ereallocarray() and eallocarray()     functions. An unauthenticated, remote attacker can     possibly exploit this to have an unspecified impact.

  - A flaw exists due to the static inclusion of unused code     from the libisc, libevent, and libopts libraries. An     unauthenticated, remote attacker can possibly exploit     this to have an unspecified impact.

  - A security weakness exists in the Makefile due to a     failure to provide compile or link flags to offer     hardened security options by default.

Security fix for CVE-2017-6464 CVE-2017-6462 CVE-2017-6463 CVE-2017-6458 CVE-2017-6451.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:3071 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time     source. These packages include the ntpd service which continuously adjusts system time and utilities used     to query and configure the ntpd service.

    Security Fix(es):

    * Two vulnerabilities were discovered in the NTP server's parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by sending a crafted message. (CVE-2017-6463,     CVE-2017-6464)

    * A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious     device could send crafted messages, causing ntpd to crash. (CVE-2017-6462)

    Red Hat would like to thank the NTP project for reporting these issues. Upstream acknowledges Cure53 as     the original reporter of these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3071 advisory.

    - add disable monitor to default ntp.conf [CVE-2013-5211]
    - fix buffer overflow in datum refclock driver (CVE-2017-6462)
    - fix crash with invalid unpeer command (CVE-2017-6463)
    - fix potential crash with invalid server command (CVE-2017-6464)
    - don't limit rate of packets from sources (CVE-2016-7426)
    - don't change interface from received packets (CVE-2016-7429)
    - fix calculation of root distance again (CVE-2016-7433)
    - require authentication for trap commands (CVE-2016-9310)
    - fix crash when reporting peer event to trappers (CVE-2016-9311)
    - don't allow spoofed packets to demobilize associations (CVE-2015-7979,       CVE-2016-1547)
    - don't allow spoofed packet to enable symmetric interleaved mode       (CVE-2016-1548)
    - check mode of new source in config command (CVE-2016-2518)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - add disable monitor to default ntp.conf [CVE-2013-5211]

  - fix buffer overflow in datum refclock driver     (CVE-2017-6462)

  - fix crash with invalid unpeer command (CVE-2017-6463)

  - fix potential crash with invalid server command     (CVE-2017-6464)

  - don't limit rate of packets from sources (CVE-2016-7426)

  - don't change interface from received packets     (CVE-2016-7429)

  - fix calculation of root distance again (CVE-2016-7433)

  - require authentication for trap commands (CVE-2016-9310)

  - fix crash when reporting peer event to trappers     (CVE-2016-9311)

  - don't allow spoofed packets to demobilize associations     (CVE-2015-7979, CVE-2016-1547)

  - don't allow spoofed packet to enable symmetric     interleaved mode (CVE-2016-1548)

  - check mode of new source in config command     (CVE-2016-2518)

  - make MAC check resilient against timing attack     (CVE-2016-1550)

Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device. (CVE-2017-6462)

The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - An out-of-bounds write error exists in the mx4200_send()     function within file ntpd/refclock_mx4200.c due to     improper handling of the return value of the snprintf()     and vsnprintf() functions. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or possibly the execution of arbitrary code.
    However, neither the researcher nor vendor could find     any exploitable code path. (CVE-2017-6451)

  - Multiple stack-based buffer overflow conditions exist in     various wrappers around the ctl_putdata() function     within file ntpd/ntp_control.c due to improper     validation of certain input from the ntp.conf file.
    An unauthenticated, remote attacker can exploit these,     by convincing a user into deploying a specially     crafted ntp.conf file, to cause a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2017-6458)

  - A stack-based buffer overflow condition exists in the     datum_pts_receive() function within file     ntpd/refclock_datum.c when handling handling packets     from the '/dev/datum' device due to improper validation     of certain input. A local attacker can exploit this to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-6462)

  - A denial of service vulnerability exists when handling     configuration directives. An authenticated, remote     attacker can exploit this, via a malformed 'mode'     configuration directive, to crash the ntpd daemon.
    (CVE-2017-6464)

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6464]

A vulnerability was found in NTP, in the parsing of packets from the DPTS Clock. [CVE-2017-6462]

A vulnerability was discovered in the NTP server's parsing of configuration directives. [CVE-2017-6463]

A vulnerability was found in NTP, affecting the origin timestamp check function. [CVE-2016-9042] Impact : A remote, authenticated attacker could cause ntpd to crash by sending a crafted message.
[CVE-2017-6463, CVE-2017-6464]

A malicious device could send crafted messages, causing ntpd to crash.
[CVE-2017-6462]

An attacker able to spoof messages from all of the configured peers could send crafted packets to ntpd, causing later replies from those peers to be discarded, resulting in denial of service. [CVE-2016-9042]

According to the versions of the ntp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The Network Time Protocol (NTP) is used to synchronize     a computer's time with another reference time source.
    This package includes ntpd (a daemon which continuously     adjusts system time) and utilities used to query and     configure the ntpd daemon. Perl scripts ntp-wait and     ntptrace are in the ntp-perl package, ntpdate is in the     ntpdate package and sntp is in the sntp package. The     documentation is in the ntp-doc package. Security     Fix(es):NTP through 4.2.8p12 has a NULL Pointer     Dereference.(CVE-2019-8936)Buffer overflow in the     legacy Datum Programmable Time Server (DPTS) refclock     driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94     allows local users to have unspecified impact via a     crafted /dev/datum device.(CVE-2017-6462)NTP before     4.2.8p10 and 4.3.x before 4.3.94 allows remote     attackers to cause a denial of service (ntpd crash) via     a malformed mode configuration     directive.(CVE-2017-6464)NTP before 4.2.8p10 and 4.3.x     before 4.3.94 allows remote authenticated users to     cause a denial of service (daemon crash) via an invalid     setting in a :config directive, related to the unpeer     option.(CVE-2017-6463)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - add disable monitor to default ntp.conf [CVE-2013-5211]

  - fix buffer overflow in parsing of address in ntpq and     ntpdc (CVE-2018-12327)

  - fix CVE-2016-7429 patch to work correctly on multicast     client (#1422973)

  - fix buffer overflow in datum refclock driver     (CVE-2017-6462)

  - fix crash with invalid unpeer command (CVE-2017-6463)

  - fix potential crash with invalid server command     (CVE-2017-6464)

This ntp update to version 4.2.8p10 fixes serveral issues. This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details. Security issues fixed (bsc#1030050) :

  - CVE-2017-6464: Denial of Service via Malformed Config

  - CVE-2017-6462: Buffer Overflow in DPTS Clock

  - CVE-2017-6463: Authenticated DoS via Malicious Config     Option

  - CVE-2017-6458: Potential Overflows in ctl_put()     functions

  - CVE-2017-6451: Improper use of snprintf() in     mx4200_send()

  - CVE-2017-6460: Buffer Overflow in ntpq when fetching     reslist

  - CVE-2016-9042: 0rigin (zero origin) DoS.

  - ntpq_stripquotes() returns incorrect Value

  - ereallocarray()/eallocarray() underused

  - Copious amounts of Unused Code

  - Off-by-one in Oncore GPS Receiver

  - Makefile does not enforce Security Flags Bugfixes :

  - Remove spurious log messages (bsc#1014172).

  - clang scan-build findings

  - Support for openssl-1.1.0 without compatibility modes

  - Bugfix 3072 breaks multicastclient

  - forking async worker: interrupted pipe I/O

  - (...) time_pps_create: Exec format error

  - Incorrect Logic for Peer Event Limiting

  - Change the process name of forked DNS worker

  - Trap Configuration Fail

  - Nothing happens if minsane 

  - allow -4/-6 on restrict line with mask

  - out-of-bound pointers in ctl_putsys and decode_bitflags

  - Move ntp-kod to /var/lib/ntp, because /var/db is not a     standard directory and causes problems for transactional     updates.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
99700	openSUSE Security Update : ntp (openSUSE-2017-511)	Nessus	SuSE Local Security Checks	2017/4/27	2025/12/23	high
106504	pfSense < 2.3.4 Multiple Vulnerabilities (SA-17_04)	Nessus	Firewalls	2018/1/31	2025/10/30	critical
102131	AIX NTP v4 Advisory : ntp_advisory9.asc (IV96311) (IV96312)	Nessus	AIX Local Security Checks	2017/8/3	2025/12/4	high
101310	EulerOS 2.0 SP1 : ntp (EulerOS-SA-2017-1124)	Nessus	Huawei Local Security Checks	2017/7/10	2025/12/12	high
108989	RHEL 7 : ntp (RHSA-2018:0855)	Nessus	Red Hat Local Security Checks	2018/4/11	2024/11/7	high
97988	Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p10 Multiple Vulnerabilities	Nessus	Misc.	2017/3/27	2025/12/29	high
99053	Fedora 25 : ntp (2017-5ebac1c112)	Nessus	Fedora Local Security Checks	2017/3/30	2025/12/29	high
99597	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : ntp (SSA:2017-112-02)	Nessus	Slackware Local Security Checks	2017/4/24	2025/12/23	high
104170	RHEL 6 : ntp (RHSA-2017:3071)	Nessus	Red Hat Local Security Checks	2017/10/26	2024/11/5	high
104199	Oracle Linux 6 : ntp (ELSA-2017-3071)	Nessus	Oracle Linux Local Security Checks	2017/10/27	2024/10/22	high
104204	OracleVM 3.3 / 3.4 : ntp (OVMSA-2017-0165)	Nessus	OracleVM Local Security Checks	2017/10/27	2025/11/17	high
105399	F5 Networks BIG-IP : NTP vulnerability (K07082049)	Nessus	F5 Networks Local Security Checks	2017/12/21	2025/11/11	high
102130	AIX NTP v3 Advisory : ntp_advisory9.asc (IV96305) (IV96306) (IV96307) (IV96308) (IV96309) (IV96310)	Nessus	AIX Local Security Checks	2017/8/3	2025/12/4	high
100496	FreeBSD : FreeBSD -- Multiple vulnerabilities of ntp (3c0237f5-420e-11e7-82c5-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2017/5/30	2025/12/17	high
128941	EulerOS Virtualization for ARM 64 3.0.2.0 : ntp (EulerOS-SA-2019-1938)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	high
119823	OracleVM 3.3 / 3.4 : ntp (OVMSA-2018-0290)	Nessus	OracleVM Local Security Checks	2018/12/21	2024/7/15	critical
99468	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2017:1048-1)	Nessus	SuSE Local Security Checks	2017/4/19	2025/12/25	high

偵測

搜尋 Plugin

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

critical

high