Debian DLA-116-1 : ntp security update

Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol. CVE-2014-9293 ntpd generated a weak key for its internal use, with full administrative privileges. Attackers could use this key to reconfigure ntpd or to exploit other vulnerabilities...

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation. Stand: 14. Ergänzungslieferung 14. EL. OpenVAS Vulnerability Test $Id: GSHBM4227.nasl 7883 2017-11-23 11:22:59Z emoss $ IT-Grundschutz, 14. EL, Maßnahme 4.227 Authors: Thomas Rotter Copyright: Copyright c 2015...

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation

IT-Grundschutz M4.227: Einsatz eines lokalen NTP-Servers zur Zeitsynchronisation. Stand: 14. Ergnzungslieferung 14. EL. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Amazon Linux AMI : ntp (ALAS-2015-496)

It was reported that ntp misses validation of vallen value, leading to various information leaks. See for more details. CVE-2014-9297 It was reported that ntp allows bypassing source IP ACLs on some OSes when ::1 spoofed. CVE-2014-9298 C Tenable Network Security, Inc. The descriptive text and...

Medium: ntp

Issue Overview: It was reported http://bugs.ntp.org/showbug.cgi?id=2671 that ntp misses validation of vallen value, leading to various information leaks. See for more details. CVE-2014-9297 It was reported http://bugs.ntp.org/showbug.cgi?id=2672 that ntp allows bypassing source IP ACLs on some OS...

Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p1 Multiple Vulnerabilities

The version of the remote NTP server is 4.x prior to 4.2.8p1. It is, therefore, affected by the following vulnerabilities : - A security weakness exists due to the configauth function improperly generating default keys when no authentication key is defined in the ntp.conf file. Key size is limite...

Network Time Protocol (NTP) Server Detection

An NTP server is listening on port 123. If not securely configured, it may provide information about its version, current date, current time, and possibly system information. C Tenable Network Security, Inc. include"compat.inc"; ifdescription scriptid10884; scriptversion"1.33";...

Cisco Prime Security Manager Network Time Protocol Daemon (ntpd) Multiple Vulnerabilities (cisco-sa-20141222-ntpd)

According to its self-reported version number, the version of Cisco Prime Security Manager running on the remote host is prior to 9.3.3.2. It is, therefore, affected by multiple vulnerabilities in the bundled NTP libraries : - A security weakness exists due to the configauth function improperly...

Cisco NX-OS Multiple ntpd Vulnerabilities

The remote Cisco device is running a version of NX-OS software that is affected by the following vulnerabilities : - Errors exist related to weak cryptographic pseudorandom number generation PRNG, the functions 'ntprandom' and and 'configauth', and the 'ntp-keygen' utility. A man-in-the-middle...

Network Time Protocol Vulnerabilities (Supplement)

OVERVIEW This advisory supplement is to accompany the NCCIC/ICS-CERT advisory titled ICSA-14-353-01 Network Time Protocol Vulnerabilities that was published December 19, 2014, on the ICS‑CERT web site. Please refer to the original advisory for all the details of the vulnerabilities. The purpose o...

F5 Networks BIG-IP : NTP vulnerability (SOL15936)

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to 1 the cryptorecv function when the Autokey Authentication feature is used, 2 the ctlputdata function, and 3 the configure function. C Tenable Network...

chrony -- multiple vulnerabilities

Chrony News reports: CVE-2015-1853: DoS attack on authenticated symmetric NTP associations CVE-2015-1821: Heap-based buffer overflow in access configuration CVE-2015-1822: Use of uninitialized pointer in command processing...

Fedora 21 : ntp-4.2.6p5-27.fc21 (2015-1736)

Security fix for CVE-2014-9297, CVE-2014-9298 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. File dat...

Fedora 20 : ntp-4.2.6p5-20.fc20 (2015-1759)

Security fix for CVE-2014-9297, CVE-2014-9298 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora Update for ntp FEDORA-2015-1736

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for ntp FEDORA-2015-1759

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mandriva Linux Security Advisory : ntp (MDVSA-2015:046)

Updated ntp packages fix security vulnerabilities : Stephen Roettger of the Google Security Team, Sebastian Krahmer of the SUSE Security Team and Harlan Stenn of Network Time Foundation discovered that the length value in extension fields is not properly validated in several code paths in...

SuSE 11.3 Security Update : ntp (SAT Patch Number 10293)

ntp has been updated to fix four security issues : - ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. bsc910764. CVE-2014-9294 - The configauth function, when an auth key is not configured, improperl...

Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: Stephen Roettger of the Google Security Team, Sebastian Krahmer of the SUSE Security Team and Harlan Stenn of Network Time Foundation discovered that the length value in extension fields is not properly validated in several code paths in...

MGASA-2015-0063 Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: Stephen Roettger of the Google Security Team, Sebastian Krahmer of the SUSE Security Team and Harlan Stenn of Network Time Foundation discovered that the length value in extension fields is not properly validated in several code paths in...