Security Bulletin: Multiple vulnerabilities in Network Time Protocol (NTP) affect WebSphere DataPower XC10 Appliance

Summary There are multiple vulnerabilities in Network Time Protocol NTP implementation that is used by WebSphere DataPower XC10 Appliance. These vulnerabilities addressed include the ability to crash application and disable ntp service. Vulnerability Details CVEID: CVE-2016-7426 DESCRIPTION: NTP ...

Security Bulletin: Multiple vulnerabilities in Network Time Protocol(NTP) affect WebSphere DataPower XC10 Appliance (CVE-2016-5300, CVE-2015-7704, CVE-2015-8138)

Summary There are multiple vulnerabilities in Network Time ProtocolNTP implementation that is used by WebSphere DataPower XC10 Appliance. These vulnerabilities addressed include the ability to disable the NTP client and bypass security restrictions to bypass the timestamp validation check...

SUSE SLES12 Security Update : ntp (SUSE-SU-2018:1464-1)

This update for ntp fixes the following issues : - Update to 4.2.8p11 bsc1082210 : - CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. - CVE-2018-7182: ctlgetitem: buffer read...

SUSE-SU-2018:1464-1 Security update for ntp

This update for ntp fixes the following issues: - Update to 4.2.8p11 bsc1082210: CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. CVE-2018-7182: ctlgetitem: buffer read overrun...

GLSA-201805-12 : NTP: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201805-12 NTP: Multiple vulnerabilities Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code or caus...

Attackers Use UPnP to Sidestep DDoS Defenses

Universal Plug and Play networking protocols have never been a friend of security researchers. On Monday, Imperva gave the InfoSec community another reason to dislike UPnP. In a proof-of-concept Distributed Denial of Service DDoS attack, Imperva researchers have devised a way to exploit the UPnP...

Amazon Linux AMI : ntp (ALAS-2018-1009)

Ephemeral association time spoofing additional protection ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clo...

Medium: ntp

Issue Overview: Ephemeral association time spoofing additional protection ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modif...

Medium: ntp

Issue Overview: The monlist feature in ntprequest.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service traffic amplification via forged 1 REQMONGETLIST or 2 REQMONGETLIST1 requests, as exploited in the wild in December 2013. CVE-2013-5211 A malicious authenticated...

Scientific Linux Security Update : ntp on SL7.x x86_64 (20180410)

Security Fixes : - ntp: Authenticated DoS via Malicious Config Option CVE-2017-6463 - ntp: Denial of Service via Malformed Config CVE-2017-6464 - ntp: Buffer Overflow in DPTS Clock CVE-2017-6462 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

CentOS 7 : ntp (CESA-2018:0855)

An update for ntp is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

SA165: NTP Vulnerabilities February 2018

SUMMARY Symantec Network Protection products using affected versions of the NTP reference implementation from ntp.org are susceptible to multiple vulnerabilities. A remote attacker can exploit these vulnerabilities to execute arbitrary code, modify the target's system time, prevent the target fro...

openSUSE Security Update : ntp (openSUSE-2018-376)

This update for ntp fixes the following issues : - Update to 4.2.8p11 bsc1082210 : - CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. - CVE-2018-7182: ctlgetitem: buffer read...

Oracle Linux 7 : ntp (ELSA-2018-0855)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0855 advisory. - fix buffer overflow in datum refclock driver CVE-2017-6462 - fix crash with invalid unpeer command CVE-2017-6463 - fix potential crash with invalid...

SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:0956-1)

This update for ntp fixes the following issues : - Update to 4.2.8p11 bsc1082210 : - CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. - CVE-2018-7182: ctlgetitem: buffer read...

SUSE-SU-2018:0956-1 Security update for ntp

This update for ntp fixes the following issues: - Update to 4.2.8p11 bsc1082210: CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. CVE-2018-7182: ctlgetitem: buffer read overrun...

ntp security, bug fix, and enhancement update

4.2.6p5-28.0.1 - Bump release to avoid ULN conflict with Oracle modified errata. 4.2.6p5-28 - fix buffer overflow in datum refclock driver CVE-2017-6462 - fix crash with invalid unpeer command CVE-2017-6463 - fix potential crash with invalid server command CVE-2017-6464 - add Spectracom TSYNC...

RHEL 7 : ntp (RHSA-2018:0855)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0855 advisory. - ntp: Buffer Overflow in DPTS Clock CVE-2017-6462 - ntp: Authenticated DoS via Malicious Config Option CVE-2017-6463 - ntp: Denial of Servi...

Updated ntp packages fix security vulnerabilities

This release addresses five security issues in ntpd for Mageia 6: LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of...

MGASA-2018-0195 Updated ntp packages fix security vulnerabilities

This release addresses five security issues in ntpd for Mageia 6: LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of...