Vulnerabilities in NTPv4 affect AIX,Vulnerabilities in NTPv4 affect VIOS

IBM SECURITY ADVISORY First Issued: Mon Jun 29 10:00:16 CDT 2015 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/ntp4advisory.asc https://aix.software.ibm.com/aix/efixes/security/ntp4advisory.asc...

ntp -- control message remote Denial of Service vulnerability

ntp.org reports: Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This requires each of the following to be true: ntpd set up to allow for remote configuration not allowed by default, and knowledge of the configuration...

Amazon Linux AMI : chrony (ALAS-2015-539)

As reported upstream : When NTP or cmdmon access was configured from chrony.conf or via authenticated cmdmon with a subnet size that is indivisible by 4 and an address that has nonzero bits in the 4-bit subnet remainder e.g. 192.168.15.0/22 or f000::/3, the new setting was written to an incorrect...

Medium: chrony

Issue Overview: As reported upstream http://chrony.tuxfamily.org/News.html: When NTP or cmdmon access was configured from chrony.conf or via authenticated cmdmon with a subnet size that is indivisible by 4 and an address that has nonzero bits in the 4-bit subnet remainder e.g. 192.168.15.0/22 or...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities of the ntp-debuginfo-4.2.2p1 package for the Red Hat Enterprise Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities of the ntp-debuginfo-4.2.6p5 package for the Red Hat Enterprise Linux operating system may lead to breaches of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the ntp-perl-4.2.6p5 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the ntp-doc-4.2.6p5 package of the Red Hat Enterprise Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. Exploitation of these vulnerabilities can be carried out remotely...

ESXi 5.5 < Build 1623387 Multiple Vulnerabilities (remote check)

The remote VMware ESXi host is version 5.5 prior to build 1623387. It is, therefore, affected by multiple vulnerabilities : - Multiple integer overflow conditions exist in the bundled GNU C Library glibc due to improper validation of user-supplied input. A remote attacker can exploit these issues...

Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p2 Multiple Vulnerabilities

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p2. It is, therefore, affected by the following vulnerabilities : - The symmetric-key feature in the receive function requires a correct message authentication code MAC only if the MAC field has a nonzero length. A man-in-the-middle...

SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2015:0865-1)

ntp was updated to fix two security related flaws as well as 'slew' mode handling for leap seconds. The following vulnerabilities were fixe : - ntpd could accept unauthenticated packets with symmetric key crypto. CVE-2015-1798 - ntpd authentication did not protect symmetric associations against D...

Amazon Linux AMI : ntp (ALAS-2015-520)

The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. CVE-2015-1798 The symmetric-key feature ...

Important: ntp

Issue Overview: The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. CVE-2015-1798 The...

Fedora 21 : ntp-4.2.6p5-30.fc21 (2015-5830)

Security fix for CVE-2015-1799, CVE-2015-1798, 1210324 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora Update for ntp FEDORA-2015-5830

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 21 Update: ntp-4.2.6p5-30.fc21

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

SUSE-SU-2015:0865-1 Security update for ntp

ntp was updated to fix two security related flaws as well as 'slew' mode handling for leap seconds. The following vulnerabilities were fixe: ntpd could accept unauthenticated packets with symmetric key crypto. CVE-2015-1798 ntpd authentication did not protect symmetric associations against DoS...

Vulnerabilities of the Gentoo Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the ntp package up to version 4.2.4p7 of the Gentoo Linux operating system can lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities of the Red Hat Enterprise Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The ntp-4.2.2p1 package of the Red Hat Enterprise Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to violations of confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

The vulnerability of the ntpd implementation of the Network Time Synchronization Protocol allows a attacker to cause a service failure.

The vulnerability of the ntpd implementation of the Network Time Synchronization protocol is related to insufficient control over the amount of network messages transmitted. Exploiting this vulnerability allows a malicious actor to cause service failures by sending specially crafted REQMONGETLIST...