The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p2.
It is, therefore, affected by the following vulnerabilities :

  - The symmetric-key feature in the receive() function     requires a correct message authentication code (MAC)     only if the MAC field has a nonzero length. A     man-in-the-middle attacker can exploit this to spoof     packets by omitting the MAC. (CVE-2015-1798)

  - A flaw exists in the symmetric-key feature in the     receive() function when handling a specially crafted     packet sent to one of two hosts that are peering with     each other. An attacker can exploit this to cause the     next attempt by the servers to synchronize to fail.
    (CVE-2015-1799)

  - A flaw exists in util/ntp-keygen.c due to the way that     the ntp-keygen utility generates MD5 symmetric keys on     big-endian systems. A remote attacker can exploit this     to more easily guess MD5 symmetric keys and thereby     spoof an NTP server or client. (CVE-2015-3405)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - reject packets without MAC when authentication is     enabled (CVE-2015-1798)

  - protect symmetric associations with symmetric key     against DoS attack (CVE-2015-1799)

  - fix generation of MD5 keys with ntp-keygen on big-endian     systems (CVE-2015-3405)

  - log when stepping clock for leap second or ignoring it     with -x (#1204625)

  - fix typos in ntpd man page (#1194463)

  - validate lengths of values in extension fields     (CVE-2014-9297)

  - drop packets with spoofed source address ::1     (CVE-2014-9298)

  - add nanosecond support to SHM refclock (#1117704)

  - allow creating all SHM segments with owner-only access     (#1122015)

  - allow symmetric keys up to 32 bytes again (#1053551)

  - fix calculation of root dispersion (#1045376)

  - fix crash in ntpq mreadvar command (#1165141)

  - don't step clock for leap second with -x option     (#1190619)

  - don't drop packets with source port below 123 (#1171630)

  - use larger RSA exponent in ntp-keygen (#1184421)

  - refresh peers on routing updates (#1193850)

  - increase memlock limit again (#1053568)

  - warn when monitor can't be disabled due to limited     restrict (#1166596)

  - improve documentation of restrict command (#1069019)

  - update logconfig documentation for patched default     (#1193849)

  - don't build ntpsnmpd (#995134)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2231 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time     with another referenced time source. These packages include the ntpd     service which continuously adjusts system time and utilities used to query     and configure the ntpd service.

    It was found that because NTP's access control was based on a source IP     address, an attacker could bypass source IP restrictions and send     malicious control and configuration packets by spoofing ::1 addresses.
    (CVE-2014-9298, CVE-2014-9751)

    A denial of service flaw was found in the way NTP hosts that were peering     with each other authenticated themselves before updating their internal     state variables. An attacker could send packets to one peer host, which     could cascade to other peers, and stop the synchronization process among     the reached peers. (CVE-2015-1799)

    A flaw was found in the way the ntp-keygen utility generated MD5 symmetric     keys on big-endian systems. An attacker could possibly use this flaw to     guess generated MD5 keys, which could then be used to spoof an NTP client     or server. (CVE-2015-3405)

    A stack-based buffer overflow was found in the way the NTP autokey protocol     was implemented. When an NTP client decrypted a secret received from an NTP     server, it could cause that client to crash. (CVE-2014-9297, CVE-2014-9750)

    It was found that ntpd did not check whether a Message Authentication Code     (MAC) was present in a received packet when ntpd was configured to use     symmetric cryptographic keys. A man-in-the-middle attacker could use this     flaw to send crafted packets that would be accepted by a client or a peer     without the attacker knowing the symmetric key. (CVE-2015-1798)

    The CVE-2015-1798 and CVE-2015-1799 issues were discovered by Miroslav     Lichvr of Red Hat.

    Bug fixes:

    * The ntpd service truncated symmetric keys specified in the key file to 20     bytes. As a consequence, it was impossible to configure NTP authentication     to work with peers that use longer keys. With this update, the maximum key     length has been changed to 32 bytes. (BZ#1191111)

    * The ntpd service could previously join multicast groups only when     starting, which caused problems if ntpd was started during system boot     before network was configured. With this update, ntpd attempts to join     multicast groups every time network configuration is changed. (BZ#1207014)

    * Previously, the ntp-keygen utility used the exponent of 3 when generating     RSA keys. Consequently, generating RSA keys failed when FIPS mode was     enabled. With this update, ntp-keygen has been modified to use the exponent     of 65537, and generating keys in FIPS mode now works as expected.
    (BZ#1191116)

    * The ntpd service dropped incoming NTP packets if their source port was     lower than 123 (the NTP port). With this update, ntpd no longer checks the     source port number, and clients behind NAT are now able to correctly     synchronize with the server. (BZ#1171640)

    Enhancements:

    * This update adds support for configurable Differentiated Services Code     Points (DSCP) in NTP packets, simplifying configuration in large networks     where different NTP implementations or versions are using different DSCP     values. (BZ#1202828)

    * This update adds the ability to configure separate clock stepping     thresholds for each direction (backward and forward). Use the stepback     and stepfwd options to configure each threshold. (BZ#1193154)

    * Support for nanosecond resolution has been added to the Structural     Health Monitoring (SHM) reference clock. Prior to this update, when a     Precision Time Protocol (PTP) hardware clock was used as a time source to     synchronize the system clock, the accuracy of the synchronization was     limited due to the microsecond resolution of the SHM protocol. The     nanosecond extension in the SHM protocol now allows sub-microsecond     synchronization of the system clock. (BZ#1117702)

    All ntp users are advised to upgrade to these updated packages, which     contain backported patches to correct these issues and add these     enhancements.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2     performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-     the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address     of a peer. (CVE-2015-1799)

Note that Nessus relies on the presence of the package as reported by the vendor.

ntp was updated to fix two security issues :

CVE-2015-1799: ntpd authentication did not protect symmetric associations against DoS attacks (bsc#924202)

CVE-2015-3405: ntp-keygen may generate non-random symmetric keys on big-endian systems (bsc#928321)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

NTP was updated to version 4.2.8p8 to fix several security issues and to ensure the continued maintainability of the package.

These security issues were fixed :

CVE-2016-4953: Bad authentication demobilized ephemeral associations (bsc#982065).

CVE-2016-4954: Processing spoofed server packets (bsc#982066).

CVE-2016-4955: Autokey association reset (bsc#982067).

CVE-2016-4956: Broadcast interleave (bsc#982068).

CVE-2016-4957: CRYPTO_NAK crash (bsc#982064).

CVE-2016-1547: Validate crypto-NAKs to prevent ACRYPTO-NAK DoS (bsc#977459).

CVE-2016-1548: Prevent the change of time of an ntpd client or denying service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode (bsc#977461).

CVE-2016-1549: Sybil vulnerability: ephemeral association attack (bsc#977451).

CVE-2016-1550: Improve security against buffer comparison timing attacks (bsc#977464).

CVE-2016-1551: Refclock impersonation vulnerability (bsc#977450)y

CVE-2016-2516: Duplicate IPs on unconfig directives could have caused an assertion botch in ntpd (bsc#977452).

CVE-2016-2517: Remote configuration trustedkey/ requestkey/controlkey values are not properly validated (bsc#977455).

CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC (bsc#977457).

CVE-2016-2519: ctl_getitem() return value not always checked (bsc#977458).

CVE-2015-8158: Potential Infinite Loop in ntpq (bsc#962966).

CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).

CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).

CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).

CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).

CVE-2015-7976: ntpq saveconfig command allowed dangerous characters in filenames (bsc#962802).

CVE-2015-7975: nextvar() missing length check (bsc#962988).

CVE-2015-7974: NTP did not verify peer associations of symmetric keys when authenticating packets, which might have allowed remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a 'skeleton' key (bsc#962960).

CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).

CVE-2015-5300: MITM attacker can force ntpd to make a step larger than the panic threshold (bsc#951629).

CVE-2015-5194: Crash with crafted logconfig configuration command (bsc#943218).

CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#952611).

CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#952611).

CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#952611).

CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#952611).

CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#952611).

CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#952611).

CVE-2015-7850: Clients that receive a KoD now validate the origin timestamp field (bsc#952611).

CVE-2015-7849: Prevent use-after-free trusted key (bsc#952611).

CVE-2015-7848: Prevent mode 7 loop counter underrun (bsc#952611).

CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#952611).

CVE-2015-7703: Configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#943221).

CVE-2015-7704: Clients that receive a KoD should validate the origin timestamp field (bsc#952611).

CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#952611).

CVE-2015-7691: Incomplete autokey data packet length checks (bsc#952611).

CVE-2015-7692: Incomplete autokey data packet length checks (bsc#952611).

CVE-2015-7702: Incomplete autokey data packet length checks (bsc#952611).

CVE-2015-1798: The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP required a correct MAC only if the MAC field has a nonzero length, which made it easier for man-in-the-middle attackers to spoof packets by omitting the MAC (bsc#924202).

CVE-2015-1799: The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP performed state-variable updates upon receiving certain invalid packets, which made it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer (bsc#924202).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2567-1 advisory.

    Miroslav Lichvar discovered that NTP incorrectly validated MAC fields. A remote attacker could possibly     use this issue to bypass authentication and spoof packets. (CVE-2015-1798)

    Miroslav Lichvar discovered that NTP incorrectly handled certain invalid packets. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2015-1799)

    Juergen Perlinger discovered that NTP incorrectly generated MD5 keys on big-endian platforms. This issue     could either cause ntp-keygen to hang, or could result in non-random keys. (CVE number pending)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2015-1799, CVE-2015-1798, #1210324

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated ntp packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source.

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses.
(CVE-2014-9298)

A denial of service flaw was found in the way NTP hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the reached peers. (CVE-2015-1799)

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. (CVE-2015-3405)

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash.
(CVE-2014-9297)

It was found that ntpd did not check whether a Message Authentication Code (MAC) was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer without the attacker knowing the symmetric key.
(CVE-2015-1798)

The CVE-2015-1798 and CVE-2015-1799 issues were discovered by Miroslav Lichvar of Red Hat.

Bug fixes :

* The ntpd daemon truncated symmetric keys specified in the key file to 20 bytes. As a consequence, it was impossible to configure NTP authentication to work with peers that use longer keys. The maximum length of keys has now been changed to 32 bytes. (BZ#1053551)

* The ntp-keygen utility used the exponent of 3 when generating RSA keys, and generating RSA keys failed when FIPS mode was enabled.
ntp-keygen has been modified to use the exponent of 65537, and generating keys in FIPS mode now works as expected. (BZ#1184421)

* The ntpd daemon included a root delay when calculating its root dispersion. Consequently, the NTP server reported larger root dispersion than it should have and clients could reject the source when its distance reached the maximum synchronization distance (1.5 seconds by default). Calculation of root dispersion has been fixed, the root dispersion is now reported correctly, and clients no longer reject the server due to a large synchronization distance.
(BZ#1045376)

* The ntpd daemon dropped incoming NTP packets if their source port was lower than 123 (the NTP port). Clients behind Network Address Translation (NAT) were unable to synchronize with the server if their source port was translated to ports below 123. With this update, ntpd no longer checks the source port number. (BZ#1171630)

Enhancements :

* This update introduces configurable access of memory segments used for Shared Memory Driver (SHM) reference clocks. Previously, only the first two memory segments were created with owner-only access, allowing just two SHM reference clocks to be used securely on a system. Now, the owner-only access to SHM is configurable with the 'mode' option, and it is therefore possible to use more SHM reference clocks securely. (BZ#1122015)

* Support for nanosecond resolution has been added to the SHM reference clock. Prior to this update, when a Precision Time Protocol (PTP) hardware clock was used as a time source to synchronize the system clock (for example, with the timemaster service from the linuxptp package), the accuracy of the synchronization was limited due to the microsecond resolution of the SHM protocol. The nanosecond extension in the SHM protocol now enables sub-microsecond synchronization of the system clock. (BZ#1117704)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1459 advisory.

    - reject packets without MAC when authentication is enabled (CVE-2015-1798)
    - protect symmetric associations with symmetric key against DoS attack       (CVE-2015-1799)
    - fix generation of MD5 keys with ntp-keygen on big-endian systems       (CVE-2015-3405)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Scientific Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2015:1459-1 advisory.

  - The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2     requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-     middle attackers to spoof packets by omitting the MAC. (CVE-2015-1798)

  - The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 3.x and 4.x before 4.2.8p2     performs state-variable updates upon receiving certain invalid packets, which makes it easier for man-in-     the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address     of a peer. (CVE-2015-1799)

  - ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with     sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20     and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a     brute force attack with the 93 possible keys. (CVE-2015-3405)

  - Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-9750, CVE-2014-9751. Reason: this     ID was intended for one issue, but was associated with two issues. Notes: All CVE users should consult     CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest. All references and descriptions in     this candidate have been removed to prevent accidental usage (CVE-2014-9297, CVE-2014-9298)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-327:04 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's     time with another reference time source. This package includes ntpd     (a daemon which continuously adjusts system time) and utilities used     to query and configure the ntpd daemon.
    Perl scripts ntp-wait and ntptrace are in the ntp-perl package and     the ntpdate program is in the ntpdate package. The documentation is     in the ntp-doc package.
    Security issues fixed with this release:
    CVE-2014-9297     CVE-2014-9298     CVE-2015-1798     CVE-2015-1799     CVE-2015-3405     Fixed bugs:
    * The ntpd daemon truncated symmetric keys specified in the key file to 20     bytes. As a consequence, it was impossible to configure NTP authentication to     work with peers that use longer keys. To fix this bug, the maximum length of keys     has now been changed to 32 bytes.
    * The ntp-keygen utility used the exponent of 3 when generating RSA keys, and     generating RSA keys failed when FIPS mode was enabled. ntp-keygen has been     modified to use the exponent of 65537, and generating keys in FIPS mode now     works as expected.
    * The ntpd daemon included a root delay when calculating its root dispersion.
    Consequently, the NTP server reported larger root dispersion than it should have     and clients could reject the source when its distance reached the maximum     synchronization distance (1.5 seconds by default). Calculation of root     dispersion has been fixed, the root dispersion is now reported correctly, and     clients no longer reject the server due to a large synchronization distance.
    * The ntpd daemon dropped incoming NTP packets if their source port was lower     than 123 (the NTP port). Clients behind Network Address Translation (NAT) were     unable to synchronize with the server if their source port was translated to     ports below 123. With this update, the bug was fixed.
    Enhancements:
    * This update introduces configurable access of memory segments used for Shared     Memory Driver (SHM) reference clocks. Previously, only the first two memory     segments were created with owner-only access, allowing just two SHM reference     clocks to be used securely on a system. Now, the owner-only access to SHM is     configurable with the mode option, and it is therefore possible to use more     SHM reference clocks securely.
    * Support for nanosecond resolution has been added to the SHM reference clock.
    Prior to this update, when a Precision Time Protocol (PTP) hardware clock was     used as a time source to synchronize the system clock (for example, with the     timemaster service from the linuxptp package), the accuracy of the     synchronization was limited due to the microsecond resolution of the SHM     protocol. The nanosecond extension in the SHM protocol now enables     sub-microsecond synchronization of the system clock.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-852:03 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's     time with another reference time source. This package includes ntpd     (a daemon which continuously adjusts system time) and utilities used     to query and configure the ntpd daemon.
    Perl scripts ntp-wait and ntptrace are in the ntp-perl package,     ntpdate is in the ntpdate package and sntp is in the sntp package.
    The documentation is in the ntp-doc package.
    Security issues fixed with this release:
    CVE-2014-9297
    ** REJECT **     DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9750,     CVE-2014-9751.  Reason: this ID was intended for one issue, but was     associated with two issues.  Notes: All CVE users should consult     CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest.
    All references and descriptions in this candidate have been removed to     prevent accidental usage.
    CVE-2014-9298
    ** REJECT **     DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-9750,     CVE-2014-9751.  Reason: this ID was intended for one issue, but was     associated with two issues.  Notes: All CVE users should consult     CVE-2014-9750 and CVE-2014-9751 to identify the ID or IDs of interest.
    All references and descriptions in this candidate have been removed to     prevent accidental usage.
    CVE-2014-9750     ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey     Authentication is enabled, allows remote attackers to obtain sensitive     information from process memory or cause a denial of service (daemon     crash) via a packet containing an extension field with an invalid     value for the length of its value field.
    CVE-2014-9751     The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before     4.2.8p1 on Linux and OS X does not properly determine whether a source     IP address is an IPv6 loopback address, which makes it easier for     remote attackers to spoof restricted packets, and read or write to the     runtime state, by leveraging the ability to reach the ntpd machine's     network interface with a packet from the ::1 address.
    CVE-2015-1798     The symmetric-key feature in the receive function in ntp_proto.c in     ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC     field has a nonzero length, which makes it easier for     man-in-the-middle attackers to spoof packets by omitting the MAC.
    CVE-2015-1799     The symmetric-key feature in the receive function in ntp_proto.c in     ntpd in NTP 3.x and 4.x before 4.2.8p2 performs state-variable updates     upon receiving certain invalid packets, which makes it easier for     man-in-the-middle attackers to cause a denial of service     (synchronization loss) by spoofing the source IP address of a peer.
    CVE-2015-3405
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * The ntpd service truncated symmetric keys specified in the key file to 20 bytes. As a consequence, it     was impossible to configure NTP authentication to work with peers that use longer keys. With this update,     the maximum key length has been changed to 32 bytes.
    * The ntpd service could previously join multicast groups only when starting, which caused problems if     ntpd was started during system boot before network was configured. With this update, ntpd attempts to join     multicast groups every time network configuration is changed.
    * Previously, the ntp-keygen utility used the exponent of 3 when generating RSA keys. Consequently,     generating RSA keys failed when FIPS mode was enabled. With this update, ntp-keygen has been modified to     use the exponent of 65537, and generating keys in FIPS mode now works as expected.
    * The ntpd service dropped incoming NTP packets if their source port was lower than 123 (the NTP port).
    With this update, ntpd no longer checks the source port number, and clients behind NAT are now able to     correctly synchronize with the server.
    Enhancements:
    * This update adds support for configurable Differentiated Services Code Points (DSCP) in NTP packets,     simplifying configuration in large networks where different NTP implementations or versions are using     different DSCP values.
    * This update adds the ability to configure separate clock stepping thresholds for each direction     (backward and forward). Use the stepback and stepfwd options to configure each threshold.
    * Support for nanosecond resolution has been added to the Structural Health Monitoring (SHM) reference     clock. Prior to this update, when a Precision Time Protocol (PTP) hardware clock was used as a time source     to synchronize the system clock, the accuracy of the synchronization was limited due to the microsecond     resolution of the SHM protocol. The nanosecond extension in the SHM protocol now allows sub-microsecond     synchronization of the system clock.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
83744	Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p2 Multiple Vulnerabilities	Nessus	Misc.	2015/5/21	2019/11/22	high
85143	OracleVM 3.3 : ntp (OVMSA-2015-0102)	Nessus	OracleVM Local Security Checks	2015/7/31	2021/1/4	high
86975	RHEL 7 : ntp (RHSA-2015:2231)	Nessus	Red Hat Local Security Checks	2015/11/20	2025/8/29	high
218584	Linux Distros Unpatched Vulnerability : CVE-2015-1799	Nessus	Misc.	2025/3/4	2026/1/28	high
84544	SUSE SLED11 / SLES11 Security Update : ntp (SUSE-SU-2015:1173-1)	Nessus	SuSE Local Security Checks	2015/7/6	2021/1/6	high
93186	SUSE SLES10 Security Update : ntp (SUSE-SU-2016:1912-1)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	critical
82765	Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2567-1)	Nessus	Ubuntu Local Security Checks	2015/4/14	2024/8/27	high
83121	Fedora 21 : ntp-4.2.6p5-30.fc21 (2015-5830)	Nessus	Fedora Local Security Checks	2015/4/29	2021/1/11	high
85025	CentOS 6 : ntp (CESA-2015:1459)	Nessus	CentOS Local Security Checks	2015/7/28	2021/1/4	high
85111	Oracle Linux 6 : ntp (ELSA-2015-1459)	Nessus	Oracle Linux Local Security Checks	2015/7/30	2025/8/29	high
85203	Scientific Linux Security Update : ntp on 6.x i686/x86_64 (2015:1459)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2025/8/29	high
289008	MiracleLinux 4 : ntp-4.2.6p5-5.0.1.AXS4 (AXSA:2015-327:04)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
289627	MiracleLinux 7 : ntp-4.2.6p5-22.0.1.el7.AXS7 (AXSA:2015-852:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

偵測

搜尋 Plugin

high

high

high

high

high

critical

high

high

high

high

high

high

high