NTP Project Network Time Protocol daemon (ntpd) contains multiple vulnerabilities (Updated)

🗓️ 19 Dec 2014 00:00:00Reported by CERTType

cert

cert🔗 www.kb.cert.org👁 159 Views

NTP Project ntpd vulnerabilities patched in version 4.2.8p

Reporter	Title	Published	Views	Family All 331
IBM Security Bulletins	Security Bulletin: IBM Netezza Host Management NTP vulnerabilities (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296)	18 Oct 201903:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Access Manager for Mobile is affected by multiple NTP vulnerabilities	16 Jun 201821:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities impact DS8000 HMC	24 May 202217:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance	17 Jun 201822:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in NTP, Hivex, glibc, libuser, BIND affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance	17 Jun 201822:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Network Time Protocol (NTP) affect PowerKVM	18 Jun 201801:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in ntp affect IBM Flex System Manager (FSM) (CVE-2014-9293, CVE-2014-9294, CVE-2014-9297, CVE-2014-9298)	31 Jan 201901:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Network Time Protocol (NTP) Affect Power Hardware Management Console (CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, CVE-2014-9296)	23 Sep 202101:31	–	ibm
IBM Security Bulletins	Security Bulletin: Fixes for Multiple Security Vulnerabilities in IBM Security Identity Manager Virtual Appliance available	16 Jun 201821:38	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Smart Analytics System 7600, 7700, 7710 and IBM PureData System for Operational Analytics is affected by multiple vulnerabilities in Network Time Protocol	18 Oct 201903:50	–	ibm

Source	Link
support	www.support.ntp.org/bin/view/Main/SecurityNotice
lists	www.lists.ntp.org/pipermail/announce/2014-December/000122.html
support	www.support.ntp.org/bin/view/Support/AccessRestrictions
ntp	www.ntp.org/downloads.html
ntp	www.ntp.org/ntpfaq/NTP-s-algo-crypt.htm
googleprojectzero	www.googleprojectzero.blogspot.com/2015/01/finding-and-exploiting-ntpd.html
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-14-353-01

27 Oct 2015 02:22Current

8.9High risk

Vulners AI Score8.9

CVSS 27.5

EPSS0.57272

ntp project ntpd vulnerabilities patch version 4.2.8p1 network time protocol authentication bypass ipv6 spoofing buffer overflow insufficient entropy crypto weak prng restrict status firewall rules autokey authentication