Denial Of Service (DoS)

ntp is vulnerable to denial of service. An incomplete fix for CVE-2014-9750 resulted in improper value length checks in ntpcrypto.c. A packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially crafted...

Denial Of Service (DoS)

ntp is vulnerable to denial of service. An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A specially crafted NTP packet could potentially cause ntpq to crash...

Denial Of Service (DoS)

ntp is vulnerable to denial of service. It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation e.g. timingstats was referenced by the statistics or filegen configuration command...

Authentication Bypass

The Network Time Protocol NTP is used to synchronize a computer's time with a referenced time source. Multiple buffer overflow flaws were discovered in ntpd's cryptorecv, ctlputdata, and configure functions. A remote attacker could use either of these flaws to send a specially crafted request...

Weak Authentication

The Network Time Protocol NTP is used to synchronize a computer's time with a referenced time source. Multiple buffer overflow flaws were discovered in ntpd's cryptorecv, ctlputdata, and configure functions. A remote attacker could use either of these flaws to send a specially crafted request...

Fedora 30 : ntp (2019-b0c7f0d94a)

Security fix for CVE-2019-8936 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network...

EulerOS 2.0 SP5 : ntp (EulerOS-SA-2019-1323)

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number o...

SUSE-SU-2018:3342-2 Security update for ntp

NTP was updated to 4.2.8p12 bsc1111853: - CVE-2018-12327: Fixed stack buffer overflow in the openhost command-line call of NTPQ/NTPDC. bsc1098531 - CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection bsc1083424 Please also see...

CVE-2019-11331

Network Time Protocol NTP, as specified in RFC 5905, uses port 123 even for modes where a fixed port number is not required, which makes it easier for remote attackers to conduct off-path attacks. Mitigation On Red Hat Enterprise Linux 6 and later, switching from ntp to chrony is recommended. Amo...

CVE-2019-11331

CVE-2019-11331 concerns Network Time Protocol (NTP) implementations that use port 123 even when a fixed port isn’t required (per RFC 5905). The provided documents confirm an off‑path attack possibility due to port usage, describing it as enabling remote actors to conduct off‑path attacks against ...

Solaris 10 (sparc) : 143725-12

SunOS 5.10: SunFreeware ntp patch. Date this patch was last updated by Sun : Apr/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid124073; scriptversion"1.2"; scriptcvsdate"Date...

Solaris 10 (x86) : 143726-12

SunOS 5.10x86: SunFreeware ntp patch. Date this patch was last updated by Sun : Apr/15/19 C Tenable Network Security, Inc. The descriptive text in this plugin was extracted from the Oracle SunOS Patch Updates. include"compat.inc"; if description scriptid124077; scriptversion"1.2";...

Preparing the Internet for the Next Mega DDoS Attack

When you think of a distributed denial-of-service DDoS attack at this point in the age of the internet, you might be thinking they’re old news. But when a multi-million-dollar business can be easily taken offline by an unskilled adversary and a $5 rent-a-DDoS service, I would argue that the issue...

Updated ntp packages fix security vulnerability

A null pointer exception which could allow an authenticated attacker to cause segmentation fault to ntpd. CVE-2019-8936...

MGASA-2019-0140 Updated ntp packages fix security vulnerability

A null pointer exception which could allow an authenticated attacker to cause segmentation fault to ntpd. CVE-2019-8936...

Mac OS X 10.10.x < 10.10.3 Multiple Vulnerabilities

Binary data 700510.prm...

EulerOS Virtualization 2.5.3 : ntp (EulerOS-SA-2019-1207)

According to the version of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted...

EulerOS Virtualization 2.5.3 : ntp (EulerOS-SA-2019-1222)

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a...

EulerOS Virtualization 2.5.4 : ntp (EulerOS-SA-2019-1213)

According to the version of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted...

openSUSE Security Update : ntp (openSUSE-2019-1158)

This update for ntp fixes the following issues : Security issue fixed: - CVE-2019-8936: Fixed a NULL pointer exception which could allow an authenticated attcker to cause segmentation fault to ntpd bsc1128525. Other isses addressed : - Fixed an issue which caused openSSL mismatch bsc1125401 - Fix...