CVE-2023-3036 Out of Bounds Slice index in cfnts leads to remote panic

An unchecked read in NTP server in github.com/cloudflare/cfnts prior to commit 783490b https://github.com/cloudflare/cfnts/commit/783490b913f05e508a492cd7b02e3c4ec2297b71 enabled a remote attacker to trigger a panic by sending an NTSAuthenticator packet with extension length longer than the packe...

[SECURITY] Fedora 38 Update: ntp-refclock-0.6-1.fc38

ntp-refclock is a wrapper for reference clock drivers included in the ntpd daemon, which enables other NTP implementations to use the supported hardware reference clocks for synchronization of the system clock. It provides a minimal environment for the drivers to be able to run in a separate...

[SECURITY] Fedora 37 Update: ntp-refclock-0.6-1.fc37

ntp-refclock is a wrapper for reference clock drivers included in the ntpd daemon, which enables other NTP implementations to use the supported hardware reference clocks for synchronization of the system clock. It provides a minimal environment for the drivers to be able to run in a separate...

Fedora 37 : ntp-refclock (2023-c0762a0e57)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-c0762a0e57 advisory. Update to latest ntp-refclock and ntp, which fixes CVE-2023-26555. Tenable has extracted the preceding description block directly from the Fedora...

Fedora 38 : ntp-refclock (2023-611a143d5f)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-611a143d5f advisory. Update to latest ntp-refclock and ntp, which fixes CVE-2023-26555. Tenable has extracted the preceding description block directly from the Fedora...

Fedora: Security Advisory for ntp-refclock (FEDORA-2023-c0762a0e57)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ntp-shop.it Cross Site Scripting vulnerability OBB-3389212

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Slackware: Security Advisory (SSA:2023-153-02)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] ntp

New ntp packages are available for Slackware 14.0, 14.1, 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/ntp-4.2.8p16-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues. For more information, see:...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current ntp Multiple Vulnerabilities (SSA:2023-153-02)

The version of ntp installed on the remote host is prior to 4.2.8p16. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-153-02 advisory. - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cpcpdec while loop. An adversary may be able ...

The vulnerability of D-Link DIR-825 router’s microprogramming software lies in the lack of measures to clean incoming data, allowing attackers to execute arbitrary commands.

The vulnerability of D-Link DIR-825 router’s microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created POST request, ntpsync.cgi, through the ntpserver...

CVE-2023-33192

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

Design/Logic Flaw

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

CVE-2023-33192 Improper handling of NTS cookie length that could crash the ntpd-rs server

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

CVE-2023-33192

CVE-2023-33192 affects ntpd-rs, a Rust NTP implementation. The issue is improper handling/validation of NTS cookie length in NTP packets, allowing a specially crafted cookie to crash the ntpd-rs server (also observed when the server is not configured to handle NTS). Root cause: unsafe or faulty s...

CVE-2023-33192 Improper handling of NTS cookie length that could crash the ntpd-rs server

ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes...

GHSA-QWHM-H7V3-MRJX Improper handling of NTS cookie length that could crash the ntpd-rs server

Impact ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS...

Improper handling of NTS cookie length that could crash the ntpd-rs server

Impact ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server. An attacker can crash the server by sending a specially crafted NTP packet containing a cookie shorter than what the server expects. The server also crashes when it is not configured to handle NTS...

SUSE SLES12 Security Update : ntp (SUSE-SU-2023:2171-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2171-1 advisory. Fixed multiple out of bound writes: CVE-2023-26551 bsc1210386, CVE-2023-26552 bsc1210388, CVE-2023-26553 bsc1210387, CVE-2023-26554...

SUSE SLES15 / openSUSE 15 Security Update : ntp (SUSE-SU-2023:2142-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2142-1 advisory. Fixed multiple out of bound writes: CVE-2023-26551 bsc1210386, CVE-2023-26552 bsc1210388, CVE-2023-26553 bsc1210387,...