Validation Bypass

ntp is vulnerable to validation bypass. It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or...

Denial Of Service (DoS)

ntp is vulnerable to denial of service. It was discovered that ntpd as a client did not correctly check timestamps in Kiss-of-Death packets. A remote attacker could use this flaw to send a crafted Kiss-of-Death packet to an ntpd client that would increase the client's polling interval value, and...

Denial Of Service (DoS)

ntp is vulnerable to denial of service DoS attacks. The vulnerability exists as the panicgate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time...

Denial Of Service (DoS)

ntp is vulnerable to denial of service DoS attacks. The vulnerability exists as a stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

Brute-force Attack

ntp is vulnerable to brute-force attacks. The vulnerability exists as the configauth function in ntpd, when the authkey is not configured, improperly generates a key that allows remote attacker to defeat the cryptographic protection mechanisms via brute-force...

ntp -- Crafted null dereference attack from a trusted source with an authenticated mode 6 packet

Network Time Foundation reports: A crafted malicious authenticated mode 6 ntpq packet from a permitted network address can trigger a NULL pointer dereference, crashing ntpd. Note that for this attack to work, the sending system must be on an address that the target's ntpd accepts mode 6 packets...

EulerOS 2.0 SP5 : ntp (EulerOS-SA-2019-1014)

According to the version of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 Note that Tenable Network Security has...

Fedora 28 : ntp (2018-e585e25b72)

Security fix for CVE-2018-12327 and fixed fix for CVE-2018-7170. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

SUSE SLES15 Security Update : ntp (SUSE-SU-2018:3386-1)

NTP was updated to 4.2.8p12 bsc1111853 : CVE-2018-12327: Fixed stack-based buffer overflow in the openhost command-line call of NTPQ/NTPDC. bsc1098531 CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection bsc1083424 Please also see...

Scientific Linux Security Update : ntp on SL6.x i386/x86_64 (20181220)

Security Fixes : - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119884; scriptversion"1.4";...

OracleVM 3.3 / 3.4 : ntp (OVMSA-2018-0290)

The remote OracleVM system is missing necessary patches to address critical security updates : - add disable monitor to default ntp.conf CVE-2013-5211 - fix buffer overflow in parsing of address in ntpq and ntpdc CVE-2018-12327 - fix CVE-2016-7429 patch to work correctly on multicast client 14229...

Oracle Linux 6 : ntp (ELSA-2018-3854)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-3854 advisory. - add disable monitor to default ntp.conf CVE-2013-5211 - fix buffer overflow in parsing of address in ntpq and ntpdc CVE-2018-12327 - fix CVE-2016-7429 patch t...

RHEL 6 : ntp (RHSA-2018:3854)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3854 advisory. - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution CVE-2018-12327 Note that Nessus has not tested for th...

CentOS 6 : ntp (CESA-2018:3854)

An update for ntp is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

CentOS Update for ntp CESA-2018:3854 centos6

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 6 : ntp (RHSA-2018:3853)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3853 advisory. The Network Time Protocol NTP is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service...

Low: Red Hat Security Advisory: ntp security update

An update for ntp is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE lin...

ntp security update

4.2.6p5-15.0.1 - add disable monitor to default ntp.conf CVE-2013-5211 4.2.6p5-15 - fix buffer overflow in parsing of address in ntpq and ntpdc CVE-2018-12327 4.2.6p5-14 - fix CVE-2016-7429 patch to work correctly on multicast client 1422973 4.2.6p5-13 - fix buffer overflow in datum refclock driv...

TOTOLINK A3002RU System Command Injection Vulnerability (CNVD-2018-26643)

TOTOLINK A3002RU is a wireless router product from Gion Electronics TOTOLINK. A command injection vulnerability exists in fromNtp in TOTOLINK A3002RU version 1.0.8. An attacker can exploit this vulnerability to execute system commands with the help of the 'ntpServerIp2' POST parameter...

CVE-2018-13307

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable...