DEBIAN-CVE-2014-9750

ntpcrypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service daemon crash via a packet containing an extension field with an invalid value for the length of its value...

[SECURITY] Fedora 23 Update: ntp-4.2.6p5-33.fc23

The Network Time Protocol NTP is used to synchronize a computer's time with another reference time source. This package includes ntpd a daemon which continuously adjusts system time and utilities used to query and configure the ntpd daemon. Perl scripts ntp-wait and ntptrace are in the ntp-perl...

NTP logconfig configuration command denial of service vulnerability

Network Time Protocol is a protocol used to synchronize a computer's time to its server or clock source e.g., quartz clock, GPS, etc.. NTP crashes due to uninitialized variables when processing the malformed logconfig configuration command ntpd, allowing remote attackers to exploit the...

NTP 'ntpd/ntp_config.c' Denial of Service Vulnerability

Network Time Protocol is a protocol used to synchronize a computer's time to its server or clock source e.g., quartz clock, GPS, etc.. NTP crashes when processing config commands with the statistics type ntpd, which can be exploited by a remote attacker to submit a special request for a denial of...

NTP NTP Packet Denial of Service Vulnerability

Network Time Protocol is a protocol used to synchronize a computer's time to its server or clock source e.g., quartz clock, GPS, etc.. NTP can cause sntp to hang when processing special NTP packets, which can be exploited by remote attackers to submit special requests for denial of service...

Multiple Arbitrary File Overwrite Vulnerabilities in NTP

Network Time Protocol is a protocol used to synchronize a computer's time to its server or clock source e.g., quartz clock, GPS, etc.. The NTP :config command can set the pidfile and driftfile paths without restriction, allowing remote attackers to exploit this vulnerability to overwrite files on...

AIX 7.1 TL 2 : ntp (IV74262)

Network Time Protocol NTP Project NTP daemon ntpd is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization. %NASLMINLEVEL...

AIX 7.1 TL 3 : ntp (IV74261)

The remote AIX host has a version of Network Time Protocol NTP installed that is affected by a denial of service vulnerability due to a flaw in the symmetric-key feature in the receive function in file ntpproto.c when receiving certain invalid packets, which causes state-variable updates to be...

AIX 6.1 TL 9 : ntp (IV73783)

Network Time Protocol NTP Project NTP daemon ntpd is vulnerable to a denial of service, caused by an error when using symmetric key authentication. By sending specially-crafted packets to both peering hosts, an attacker could exploit this vulnerability to prevent synchronization. %NASLMINLEVEL...

UBUNTU-CVE-2015-5195

ntpopenssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service segmentation fault via a crafted statistics or filegen configuration command that is not enabled during compilation...

Vulnerability in NTPv3 affects AIX,Vulnerability in NTPv3 affects VIOS

IBM SECURITY ADVISORY First Issued: Fri Aug 21 09:06:03 CDT 2015 |Updated: Mon Feb 15 13:19:18 CST 2016 |Update: Changed AIX 6.1.8 and 7.1.2 impacted levels. The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/ntpadvisory3.asc...

CentOS 6 : ntp (CESA-2015:1459)

Updated ntp packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give...

ntp, ntpdate security update

CentOS Errata and Security Advisory CESA-2015:1459 Updated ntp packages that fix multiple security issues, several bugs, and add two enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerabili...

ntp: vallen in extension fields are not validated

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

ntp: drop packets with source address ::1

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses...

ntp: vallen in extension fields are not validated

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash...

ntp: drop packets with source address ::1

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses...

ntp: ntpd accepts unauthenticated packets with symmetric key crypto

It was found that ntpd did not check whether a Message Authentication Code MAC was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer witho...

ntp: authentication doesn't protect symmetric associations against DoS attacks

A denial of service flaw was found in the way NTP hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the...

ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server...