NTP: Multiple vulnerabilities

Background NTP contains software for the Network Time Protocol. Description Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details. Impact A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition...

ntp, ntpdate, sntp security update

CentOS Errata and Security Advisory CESA-2018:0855 An update for ntp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

CVE-2018-2763

Vulnerability in the Solaris component of Oracle Sun Systems Products Suite subcomponent: NTPD. The supported version that is affected is 11.3. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Solaris executes to compromise Solaris. Successful...

ntp: Denial of Service via Malformed Config

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message...

Moderate: Red Hat Security Advisory: ntp security, bug fix, and enhancement update

An update for ntp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

ntp: Buffer Overflow in DPTS Clock

A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash...

ntp: Authenticated DoS via Malicious Config Option

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message...

[SECURITY] Fedora 26 Update: ntp-4.2.8p11-1.fc26

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts are in the ntp-perl package, ntpdate is in...

ntp buffer overflow vulnerability (CNVD-2018-06628)

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. ntpd is an operating system daemon. A buffer overflow vulnerability exists in the 'decodearr' function of ntpq in NTP versions 4.2.8p6 through 4.2.8p10. A remote attacker could...

DEBIAN-CVE-2018-7183

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array...

UBUNTU-CVE-2018-7183

Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array...

NTP nptd Unauthorized Modification Vulnerability

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. ntpd is an operating system daemon. A security vulnerability exists in nptd in versions 4.2.x prior to NTP 4.2.8p7 and 4.3.x prior to 4.3.92. An attacker can exploit this...

ntp denial of service vulnerability (CNVD-2018-04872)

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. ntpd is an operating system daemon. A security vulnerability exists in ntpd in version 4.2.8p4 before NTP 4.2.8p11. A remote attacker could exploit this vulnerability to cause a...

NTP ntpd denial of service vulnerability (CNVD-2018-04874)

NTP Network Time Protocol is a network protocol that synchronizes the clocks of two computers by exchanging packets. ntpd is an operating system daemon. An information disclosure vulnerability exists in the ctlgetitem method of ntpd in NTP versions 4.2.8p6 through 4.2.8p10. A remote attacker coul...

ntp denial of service vulnerability (CNVD-2018-04873)

NTP Network Time Protocol is a protocol for synchronizing computer clocks over a network. protocol engine is one of the protocol engines. A security vulnerability exists in the protocol engine in versions 4.2.6 prior to NTP 4.2.8p11. A remote attacker could exploit this vulnerability by sending...

DEBIAN-CVE-2018-7185

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service disruption by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association...

DEBIAN-CVE-2018-7182

The ctlgetitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service out-of-bounds read via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10...

UBUNTU-CVE-2018-7170

ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an...

UBUNTU-CVE-2018-7184

ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service disruption by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the mos...

UBUNTU-CVE-2018-7185

The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service disruption by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association...