CVE-2015-7977

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service NULL pointer dereference via a ntpdc reslist command...

CVE-2015-7973

NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network...

CVE-2015-7975

The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service application crash...

CVE-2015-7978

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service stack exhaustion via an ntpdc relist command, which triggers recursive traversal of the restriction list...

CVE-2015-8158

The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service infinite loop via crafted packets with incorrect values...

KDE Systemsettings: Privilege escalation

Background KDE workspace configuration module for setting the date and time has a helper program which runs as root for performing actions. Description KDE Systemsettings fails to properly validate user input before passing it as argument in context of higher privilege. Impact A local attacker...

VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2014-0002)

The remote VMware ESX / ESXi host is affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the glibc package in file malloc/malloc.c. An unauthenticated, remote attacker can exploit these to cause heap memory corruption by passing large values to the pvalloc,...

Siemens RUGGEDCOM ROX-based devices authentication bypass Vulnerability, CVE-2 0 1 5-7 8 7 1-a vulnerability warning-the black bar safety net

Affected system: Siemens RUGGEDCOM ROX 2.9.0 Description: CVECAN ID: CVE-2 0 1 5-7 8 7 1 Siemens RUGGEDCOM based on the ROX device for connection to the harsh environment of the equipment. Siemens RUGGEDCOM ROX-based devices exist authentication bypass vulnerability, by sending a configuration of...

Siemens RUGGEDCOM ROX-based devices NTP input validation Vulnerability, CVE-2 0 1 5-5 3 0 0-a vulnerability warning-the black bar safety net

Affected system: Siemens RUGGEDCOM ROX 2.9.0 Description: CVECAN ID: CVE-2 0 1 5-5 3 0 0 Siemens RUGGEDCOM based on the ROX device for connection to the harsh environment of the equipment. Siemens RUGGEDCOM ROX-based devices there is an input validation vulnerability, in some circumstances, by...

Scientific Linux Security Update : chrony on SL7.x x86_64 (20151119)

An out-of-bounds write flaw was found in the way chrony stored certain addresses when configuring NTP or cmdmon access. An attacker that has the command key and is allowed to access cmdmon only localhost is allowed by default could use this flaw to crash chronyd or, possibly, execute arbitrary co...

Scientific Linux Security Update : ntp on 7.x x86_64 (2015:2231)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2015:2231-4 advisory. - The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field...

AIX 6.1 TL 9 : bos.net.tcp.client (U861500)

The remote host is missing AIX PTF U861500, which is related to the security of the package bos.net.tcp.client. Product could allow a remote attacker to obtain sensitive information, caused by a design error when using the SSLv3 protocol. A remote user with the ability to conduct a...

CentOS 7 : chrony (CESA-2015:2241)

Updated chrony packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CentOS 7 : ntp (CESA-2015:2231)

Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

RHEL 6 : ntp (RHSA-2015:2520)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:2520 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with a referenced time source. It was discovered that ntpd as a client did not...

SA103 : October 2015 NTP Security Vulnerabilities

SUMMARY Blue Coat products using affected 4.2 versions of the NTP software distribution from ntp.org are susceptible to multiple vulnerabilities. A remote attacker may exploit these vulnerabilities to cause denial of service due to application crashes, memory corruption and memory depletion. The...

Oracle: Security Advisory (ELSA-2015-2231)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 7 : ntp (ELSA-2015-2231)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2231 advisory. - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 -...

ntp security, bug fix, and enhancement update

4.2.6p5-22 - check origin timestamp before accepting KoD RATE packet CVE-2015-7704 - allow only one step larger than panic threshold with -g CVE-2015-5300 4.2.6p5-20 - validate lengths of values in extension fields CVE-2014-9297 - drop packets with spoofed source address ::1 CVE-2014-9298 - rejec...

SUSE SLED11 / SLES11 Security Update : ntp (SUSE-SU-2015:2058-1)

This ntp update provides the following security and non security fixes : - Update to 4.2.8p4 to fix several security issues bsc951608 : - CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK - CVE-2015-7855: decodenetnum will ASSERT botch instead of returni...