[oCERT-2014-010] SoX input sanitization errors

2014-010 SoX input sanitization errors Description: The SoX project is an open source tool for sound processing. The sox command line tool is affected by two heap-based buffer overflows, respectively located in functions startread and AdpcmReadBlock. A specially crafted wav file can be used to...

SuSE 11.3 Security Update : ntp (SAT Patch Number 10117)

This ntp update fixes the following critical security issue : - A potential remote code execution problem was found inside ntpd. The functions cryptorecv when using autokey authentication and ctlputdata where updated to avoid buffer overflows that could have been exploited. CVE-2014-9295 / VU8528...

Debian DSA-3108-1 : ntp - security update

Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. - CVE-2014-9293 ntpd generated a weak key for its internal use, with full administrative privileges. Attackers could use this key to reconfigure ntpd or to exploit other vulnerabilities. -...

USN-2449-1 ntp vulnerabilities

Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use this issue to brute force the authentication key and send requests if permitted by IP restrictions. CVE-2014-9293 Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker...

USN-2449-1: NTP vulnerabilities

Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use this issue to brute force the authentication key and send requests if permitted by IP restrictions. CVE-2014-9293 Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker...

Security update for ntp (critical)

The network timeservice ntp was updated to fix critical security issues bnc910764, CERT VU852879 A potential remote code execution problem was found inside ntpd. The functions cryptorecv when using autokey authentication, ctlputdata, and configure where updated to avoid buffer overflows that coul...

Debian: Security Advisory (DSA-3112-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ntp: multiple issues

Keys explicitly generated by "ntp-keygen -M" should be regenerated. - CVE-2014-9293 weak key generation ntpd generated a weak key for its internal use, with full administrative privileges. Attackers could use this key to reconfigure ntpd or to exploit other vulnerabilities. - CVE-2014-9294 weak k...

Oracle Linux 6 / 7 : ntp (ELSA-2014-2024)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-2024 advisory. - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via...

openSUSE Security Update : ntp (openSUSE-SU-2014:1670-1)

The network timeservice ntp was updated to fix critical security issues bnc910764, CERT VU852879 - A potential remote code execution problem was found inside ntpd. The functions cryptorecv when using autokey authentication, ctlputdata, and configure where updated to avoid buffer overflows that...

[SECURITY] [DLA 116-1] ntp security update

Package : ntp Version : 4.2.6.p2+dfsg-1+deb6u1 CVE ID : CVE-2014-9293 CVE-2014-9294 CVE-2014-9295 CVE-2014-9296 Debian Bug : 773576 Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. CVE-2014-9293 ntpd generated a weak key for its internal...

Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated CVE-2014-9293. ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys...

CVE-2014-9295

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to 1 the cryptorecv function when the Autokey Authentication feature is used, 2 the ctlputdata function, and 3 the configure function...

Stack overflow

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to 1 the cryptorecv function when the Autokey Authentication feature is used, 2 the ctlputdata function, and 3 the configure function...

Security update for ntp (critical)

The network timeservice ntp was updated to fix critical security issues bnc910764, CERT VU852879 A potential remote code execution problem was found inside ntpd. The functions cryptorecv when using autokey authentication, ctlputdata, and configure where updated to avoid buffer overflows that coul...

openSUSE: Security Advisory for ntp (openSUSE-SU-2014:1670-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DLA-116-1 ntp - security update

Bulletin has no description...

ntp security update

4.2.6p5-2 - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via specially-crafted packets CVE-2014-9295 - don't mobilize passive association when authentication fails CVE-2014-9296...

Debian Security Advisory DSA 3108-1 (ntp - security update)

Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. CVE-2014-9293 ntpd generated a weak key for its internal use, with full administrative privileges. Attackers could use this key to reconfigure ntpd or to exploit other vulnerabilities...

ntp security update

4.2.2p1-18.el5 - don't generate weak control key for resolver CVE-2014-9293 - don't generate weak MD5 keys in ntp-keygen CVE-2014-9294 - fix buffer overflows via specially-crafted packets CVE-2014-9295...