UBUNTU-CVE-2015-7976

The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename...

UBUNTU-CVE-2015-7978

NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service stack exhaustion via an ntpdc relist command, which triggers recursive traversal of the restriction list...

UBUNTU-CVE-2015-7975

The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service application crash...

UBUNTU-CVE-2015-8138

NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero...

CentOS 7 : chrony (CESA-2015:2241)

Updated chrony packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

ntp, ntpdate, sntp security update

CentOS Errata and Security Advisory CESA-2015:2231 Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common...

Important: Red Hat Security Advisory: ntp security update

Updated ntp packages that fix one security issue are now available for Red Hat Enterprise Linux 6.5 and 6.6 Extended Update Support. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

ntp: disabling synchronization via crafted KoD packet

It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and effectively disable synchronization with...

Network Time Protocol Daemon Pidfile Driftfile Arbitrary File Overwrite (CVE-2015-7709)

An arbitrary file overwrite vulnerability exists in the Network Time Protocol daemon NTPD. The vulnerability is due to NTPD allowing remote clients to change the pidfile and driftfile configuration options to any arbitrary file, allowing any file on the target system to be overwritten. A remote,...

RHEL 7 : chrony (RHSA-2015:2241)

Updated chrony packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

ntp: ntpd accepts unauthenticated packets with symmetric key crypto

It was found that ntpd did not check whether a Message Authentication Code MAC was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer witho...

ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server...

Moderate: Red Hat Security Advisory: ntp security, bug fix, and enhancement update

Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

ntp: authentication doesn't protect symmetric associations against DoS attacks

A denial of service flaw was found in the way NTP hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the...

ntp: drop packets with source address ::1

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses...

ntp: drop packets with source address ::1

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses...

chrony: Heap out of bound write in address filter

An out-of-bounds write flaw was found in the way Chrony stored certain addresses when configuring NTP or cmdmon access. An attacker that has the command key and is allowed to access cmdmon only localhost is allowed by default could use this flaw to crash chronyd or, possibly, execute arbitrary co...

Moderate: Red Hat Security Advisory: chrony security, bug fix, and enhancement update

Updated chrony packages that fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

网络时间协议 NTP KoD 拒绝服务攻击

No description provided by source...

Network Time Protocol Security Bypass Vulnerability

Network Time Protocol is a set of protocols for synchronizing computer clocks over a network. A security bypass vulnerability exists in Network Time Protocol that could allow a remote attacker to perform a man-in-the-middle attack to bypass security restrictions and perform unauthorized operation...