遠端 Scientific Linux 7 主機已安裝受到 SLSA-2015:2231-4 公告中所提及的多個弱點影響的套件。

  - 在 4.2.8p2 之前的 版 NTP 4.x 中ntpd 內 ntp_proto.c 的接收函式中的對稱式金鑰只有在 MAC 欄位長度非零時才需要正確的 MAC這可讓攔截式攻擊更容易攻擊者可省略 MAC 來偽造封包。 (CVE-2015-1798)

  - 在 4.2.8p2 之前的 版 NTP 3.x 和 4.x 中ntpd 內 ntp_proto.c 的接收函式內收到特定的無效封包時會執行狀態變數更新進而使攔截式攻擊更容易發生攻擊者可偽造對等節點的來源 IP 位址造成拒絕服務 (缺乏同步化)。 (CVE-2015-1799)

  - 4.3.x 當temp 變數的最低位元組介於 0x20 和 0x7f 4.3.12 之間且不是其可能允許遠端攻擊者透過使用 93 個可能金鑰的暴力密碼破解攻擊取得所產生 MD5 金鑰的值。 (CVE-2015-3405)

  - 在 Linux 和 OS X 4.2.8p1 之前的 版 NTP 4.x 中ntpd 內 ntp_io.c 的 read_network_packet 函式未正確判斷來源 IP 位址是否為 IPv6 回送位址進而使遠端攻擊者更容易偽造受限制的封包以及讀取或寫入運行時間狀態方法是利用從 ::1 位址使用封包連線至 ntpd 電腦網路介面的能力。 (CVE-2014-9751)

  - 在 4.2.8p1 之前的 NTP 4.x 中ntpd 的 ntp_crypto.c 允許遠端攻擊者透過包含延伸欄位為其值欄位的長度值無效。
    (CVE-2014-9750)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

在 ntp 套件 (網路時間通訊協定的實作) 中發現數個弱點。Common Vulnerabilities and Exposures 專案發現下列問題：

- CVE-2014-9750 Google 安全性團隊的 Stephen Roettger、SUSE 安全性團隊的 Sebastian Krahmer，以及 Network Time Foundation 的 Harlan Stenn 發現，在 ntp_crypto.c 的數個程式碼路徑中，系統並未正確驗證延伸欄位的長度值，而可導致資訊洩漏或拒絕服務 (ntpd 損毀)。

- CVE-2014-9751 Google 安全性團隊的 Stephen Roettger 報告，可繞過以 IPv6::1 位址為基礎的 ACL。

安全性修正：

- 據發現，CVE-2014-9750 的修正並不完整：在 NTP 之 ntp_crypto.c 的值長度檢查中發現三個問題，具有特定自動金鑰作業且包含惡意資料的封包並非每一次都經過完整驗證。遠端攻擊者可使用特製 NTP 封包造成 ntpd 損毀。(CVE-2015-7691、CVE-2015-7692、CVE-2015-7702)

- 在 ntpd 的 CRYPTO_ASSOC 中發現一個記憶體洩漏瑕疵。如果 ntpd 設為使用自動金鑰驗證，攻擊者即可傳送封包至 ntpd，並且連續數天發動攻擊，從而造成其記憶體不足。(CVE-2015-7701)

- 在 ntpq 的 cookedprint 功能中發現一個差一瑕疵，其可導致緩衝區溢位。特製 NTP 封包可能造成 ntpq 損毀。(CVE-2015-7852)

- 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個 NULL 指標解除參照瑕疵。遠端攻擊者可能利用此瑕疵造成 ntpd 損毀。(CVE-2015-7977)

- 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個堆疊型緩衝區溢位瑕疵。遠端攻擊者可利用此瑕疵造成 ntpd 損毀。
 (CVE-2015-7978)

- 據發現，ntpd 在處理格式錯誤之 logconfig 組態命令時可能因未初始化的變數而損毀。(CVE-2015-5194)

- 據發現，當未啟用的統計資料類型在編譯時 (如 timingstats) 受到統計資料或 filegen 組態命令參照時，ntpd 會因分割錯誤而結束。
 (CVE-2015-5195)

- 據發現，sntp 公用程式會因處理特製 NTP 封包時，在無限迴圈中擷取而變得沒有回應。(CVE-2015-5219)

- 據發現，NTP 的 :config 命令可用於設定 pidfile 和 driftfile 路徑，而無任何限制。遠端攻擊者可利用此瑕疵，將檔案系統上的檔案覆寫為含有 ntpd 處理程序 pid 的檔案 (立即)，或是系統時鐘目前的預估偏離 (以小時為間隔)。(CVE-2015-7703)

CVE-2015-5219 和 CVE-2015-7703 問題由 Miroslav Lichvr (Red Hat) 發現。

現已提供適用於 Red Hat Enterprise Linux 6 的更新版 ntp 套件，可修正多個安全性問題、數個錯誤，並新增兩個增強功能。

Red Hat 產品安全性團隊已將此更新評等為具有中等安全性影響。可針對每個弱點從〈參照〉一節的 CVE 連結中取得常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

網路時間通訊協定 (NTP) 可用來同步電腦的時間與另一個參照的時間來源。

據發現，由於 NTP 的存取控制是以來源 IP 位址為基礎，因此攻擊者可透過偽造 ::1 位址繞過來源 IP 限制，並傳送惡意的控制項與組態封包。
(CVE-2014-9298)

更新內部狀態變數之前，在彼此對等的 NTP 主機用於自行驗證的方式中發現一個拒絕服務瑕疵。攻擊者可將封包傳送至一個對等主機，這可能與其他對等主機重疊顯示，並停止可觸及之對等主機的同步處理程序。(CVE-2015-1799)

在 ntp-keygen 公用程式於位元組由大到小的系統上產生 MD5 對稱金鑰的方式中發現一個瑕疵。攻擊者可能利用此瑕疵猜測已產生的 MD5 金鑰，然後利用這些金鑰偽造 NTP 用戶端或伺服器。(CVE-2015-3405)

在實作 NTP 自動金鑰通訊協定的方式中發現一個堆疊型緩衝區溢位。當 NTP 用戶端解密接收自 NTP 伺服器的密碼時，可能會使該用戶端當機。
(CVE-2014-9297)

據發現，當 ntpd 設定為使用對稱密碼解譯金鑰時，ntpd 不會檢查所接收的封包中是否存在訊息驗證碼 (MAC)。攔截式攻擊者可利用此瑕疵，在攻擊者不知道對稱金鑰的情況下傳送特製封包，並由用戶端或對等主機接受。
(CVE-2015-1798)

CVE-2015-1798 和 CVE-2015-1799 問題由 Red Hat 的 Miroslav Lichvár 發現。

錯誤修正：

* ntpd 程序會將金鑰檔案中所指定的對稱金鑰截斷為 20 個位元組。因此，無法設定 NTP 驗證處理使用較長金鑰的對等。金鑰長度上限現在已變更為 32 個位元組。(BZ#1053551)

* ntp-keygen 公用程式使用指數為 3 的 RSA 金鑰，因此在啟用 FIPS 模式時，產生 RSA 金鑰失敗。
ntp-keygen 已經修改，可使用指數 65537，因此，在 FIPS 模式下產生金鑰現在可如預期般運作。(BZ#1184421)

* ntpd 程序在計算其 root 散佈時，包含 root 延遲。因此，NTP 伺服器所報告的 root 散佈比其應當具備的值還大，因而在其距離達到最大同步距離 (預設為 1.5 秒) 時，用戶端可能會拒絕來源。root 散佈的計算已經修正，現在會正確報告 root 散佈結果，因此用戶端不再會因為同步距離大而拒絕伺服器。
(BZ#1045376)

* 如果 ntpd 程序的來源連接埠低於 123 (NTP 連接埠)，則會捨棄傳入的 NTP 封包。對於網路位址轉譯 (NAT) 之後的用戶端，如果其來源連接埠轉譯為低於 123 的連接埠，則這些用戶端無法與伺服器同步。使用此更新時，ntpd 不再會檢查來源連接埠號碼。(BZ#1171630)

增強功能：

* 此更新引入共用記憶體驅動程式 (SHM) 參照時間所使用之記憶體區段的可設定存取權。先前，只會建立僅限擁有者存取的前兩個記憶體區段，這樣只允許在系統上安全地使用兩個 SHM 參照時鐘。現在可使用「模式」選項設定 SHM 的僅限擁有者存取權，因此可以安全地使用更多 SHM 參照時鐘。(BZ#1122015)

* 已將 nanosecond 解析的支援新增至 SHM 參照時鐘。在此更新之前，使用精確時間通訊協定 (PTP) 硬體時鐘作為同步系統時鐘的時間來源時 (例如，使用 linuxptp 套件中的 timemaster 服務)，同步的準確度會因為 SHM 通訊協定的毫秒解析而受到限制。SHM 通訊協定中的 nanosecond 延伸模組現在會啟用系統時鐘的子毫秒同步。(BZ#1117704)

更新后的 ntp 程序包修复了多个安全问题和缺陷并添加了两项增强，现在可用于 Red Hat Enterprise Linux 6。

Red Hat 产品安全团队将此更新评级为具有中等安全影响。可从“参考”部分中的 CVE 链接获取针对每个漏洞的通用漏洞评分系统 (CVSS) 基本分数，其给出了详细的严重性等级。

网络时间协议 (NTP) 用于将计算机的时间与其他引用时间源进行同步。

已发现由于 NTP 的访问控制基于源 IP 地址，攻击者可以绕过源 IP 限制，通过欺骗 ::1 地址来发送恶意控制和配置数据包。
(CVE-2014-9298)

在 NTP 主机相互进行对等操作的方式中发现拒绝服务缺陷，这些主机会在更新其内部状态变量之前进行自我认证。攻击者可以向对等主机发送一个数据包，该数据包可级联至其他对等主机并终止其中的同步进程。(CVE-2015-1799)

在 ntp-keygen 实用工具在大端系统上生成对称 MD5 密钥的方式中发现一个缺陷。攻击者可能利用此缺陷猜测生成的 MD5 密钥，并用其欺骗 NTP 客户端或服务器。(CVE-2015-3405)

在实现 NTP autokey 协议的方式中发现基于堆栈的缓冲区溢出。当 NTP 客户端对从 NTP 服务器收到的密码进行解密时，可能导致该客户端崩溃。
(CVE-2014-9297)

已发现 ntpd 在配置为使用对称加密密钥时，不会检查所接受的数据包中是否存在消息验证代码 (MAC)。中间人攻击者可以利用此缺陷在不知道对称密钥的前提下，发送构建的数据包并使客户端或对等机接受这些数据包。
(CVE-2015-1798)

CVE-2015-1798 和 CVE-2015-1799 问题由 Red Hat 的 Miroslav Lichvár 发现。

缺陷补丁：

* ntpd 后台程序将密钥文件中指定的对称密钥截断为 20 字节。因此，无法针对使用较长密钥的对等方配置 NTP 认证。现在密钥的最大长度已更改为 32 字节。(BZ#1053551)

* ntp-keygen 实用工具生成 RSA 密钥时使用的指数为 3，且启用 FIPS 模式时无法生成 RSA 密钥。
ntp-keygen 现已修改为使用指数 65537，且在 FIPS 模式下可以按预期生成密钥。(BZ#1184421)

* ntpd 后台程序计算其根分散时包含根延迟。因此，NTP 服务器会报告比实际情况更大的根分散，当距离达到最大同步距离（默认为 1.5 秒）时，客户端可能会拒绝源。已修复根分散的计算，现在可正确报告根分散，且客户端不会因较大同步距离而拒绝服务器。
(BZ#1045376)

* 如果传入 NTP 数据包的源端口小于 123（NTP 端口），ntpd 后台程序会丢弃这些数据包。如果网络地址转换 (NAT) 后面的客户端的源端口转换为低于 123 的端口，则这些客户端无法与服务器同步。通过此更新， ntpd 不会再检查源端口号。(BZ#1171630)

增强：

* 此更新引入了用于共享内存驱动 (SHM) 参考时钟的对内存段的可配置访问。之前，仅前两个内存段通过“仅限所有者访问”创建，从而只允许在系统上安全使用两个 SHM 参考时钟。现在，SHM 的“仅限所有者访问”可通过“模式”选项进行配置，因此可以安全地使用更多 SHM 参考时钟。(BZ#1122015)

* 针对 SHM 参考时钟添加了纳秒级分辨率支持。在此更新之前，如果使用精确时间协议 (PTP) 硬件时钟作为时间源来同步系统时钟（例如使用 linuxptp 程序包中的 timemaster 服务），由于 SHM 协议使用微秒级精度，同步准确性会受限制。现在， SHM 协议的纳秒扩展使系统时钟可以进行亚微秒级的同步。(BZ#1117704)

已在 ntp 程序包（即网络时间协议的实现）中发现多个漏洞。通用漏洞和暴露计划识别以下问题：

- CVE-2014-9750 Google 安全团队的 Stephen Roettger、SUSE 安全团队的 Sebastian Krahmer 以及 Network Time Foundation 的 Harlan Stenn 发现未正确验证 ntp_crypto.c 的多个代码路径的扩展字段中的长度值，这可导致信息泄漏或拒绝服务 (ntpd 崩溃)。

- CVE-2014-9751 Google 安全团队的 Stephen Roettger 报告可绕过基于 IPv6 ::1 地址的 ACL。

安全补丁：

- 发现 CVE-2014-9750 的修复并不完整：在 NTP ntp_crypto.c 的值长度检查中发现三个问题，其中具有特定 autokey 操作且包含恶意数据的数据包并非总是经过完整验证。远程攻击者可使用特别构建的 NTP 数据包造成 ntpd 崩溃。（CVE-2015-7691、CVE-2015-7692、CVE-2015-7702）

- 在 ntpd 的 CRYPTO_ASSOC 中发现一个内存泄漏缺陷。如果 ntpd 配置为使用 autokey 认证，则攻击者可以向 ntpd 发送数据包，并在几天连续不断的攻击后造成其内存不足。(CVE-2015-7701)

- 在 ntpq 的 cookedprint 功能中发现一个差一缺陷，其可导致缓冲区溢出。特别构建的 NTP 数据包可能造成 ntpq 崩溃。(CVE-2015-7852)

- 在 ntpd 处理“ntpdc reslist”命令（可查询具有大量条目的限制列表）的方式中发现一个空指针取消引用缺陷。远程攻击者可能利用此缺陷造成 ntpd 崩溃。(CVE-2015-7977)

- 在 ntpd 处理“ntpdc reslist”命令（可查询具有大量条目的限制列表）的方式中发现一个基于堆栈的缓冲区溢出缺陷。远程攻击者可利用此缺陷造成 ntpd 崩溃。
 (CVE-2015-7978)

- 发现 ntpd 可能由于处理不规范 logconfig 配置命令时未初始化变量而崩溃。(CVE-2015-5194)

- 发现编译期间未启用的 statistics 类型（如 timingstats）
被 statistics 或 filegen 配置命令引用时，ntpd 因分段错误而退出。
 (CVE-2015-5195)

- 发现 sntp 实用工具会因处理特别构建的 NTP 数据包时，在无限循环中被捕获而失去响应。(CVE-2015-5219)

- 发现 NTP 的 :config 命令可用于设置 pidfile 和 driftfile 路径，而不受任何限制。远程攻击者可利用此缺陷将文件系统中的文件覆盖为包含 ntpd 进程 pid 的文件（立即）或当前估计的系统时钟漂移（以每小时为间隔）。(CVE-2015-7703)

CVE-2015-5219 和 CVE-2015-7703 问题由 Miroslav Lichvr (Red Hat) 发现。

CVE-2015-7691

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVE-2015-7692 The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

CVE-2015-7702 The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

Impact

An attacker may be able to craft a packet with particular autokey operations that upon receipt can cause ntpd to stop responding.

Updated ntp packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

It was found that because NTP's access control was based on a source IP address, an attacker could bypass source IP restrictions and send malicious control and configuration packets by spoofing ::1 addresses.
(CVE-2014-9298, CVE-2014-9751)

A denial of service flaw was found in the way NTP hosts that were peering with each other authenticated themselves before updating their internal state variables. An attacker could send packets to one peer host, which could cascade to other peers, and stop the synchronization process among the reached peers. (CVE-2015-1799)

A flaw was found in the way the ntp-keygen utility generated MD5 symmetric keys on big-endian systems. An attacker could possibly use this flaw to guess generated MD5 keys, which could then be used to spoof an NTP client or server. (CVE-2015-3405)

A stack-based buffer overflow was found in the way the NTP autokey protocol was implemented. When an NTP client decrypted a secret received from an NTP server, it could cause that client to crash.
(CVE-2014-9297, CVE-2014-9750)

It was found that ntpd did not check whether a Message Authentication Code (MAC) was present in a received packet when ntpd was configured to use symmetric cryptographic keys. A man-in-the-middle attacker could use this flaw to send crafted packets that would be accepted by a client or a peer without the attacker knowing the symmetric key.
(CVE-2015-1798)

The CVE-2015-1798 and CVE-2015-1799 issues were discovered by Miroslav Lichvar of Red Hat.

Bug fixes :

* The ntpd service truncated symmetric keys specified in the key file to 20 bytes. As a consequence, it was impossible to configure NTP authentication to work with peers that use longer keys. With this update, the maximum key length has been changed to 32 bytes.
(BZ#1191111)

* The ntpd service could previously join multicast groups only when starting, which caused problems if ntpd was started during system boot before network was configured. With this update, ntpd attempts to join multicast groups every time network configuration is changed.
(BZ#1207014)

* Previously, the ntp-keygen utility used the exponent of 3 when generating RSA keys. Consequently, generating RSA keys failed when FIPS mode was enabled. With this update, ntp-keygen has been modified to use the exponent of 65537, and generating keys in FIPS mode now works as expected. (BZ#1191116)

* The ntpd service dropped incoming NTP packets if their source port was lower than 123 (the NTP port). With this update, ntpd no longer checks the source port number, and clients behind NAT are now able to correctly synchronize with the server. (BZ#1171640)

Enhancements :

* This update adds support for configurable Differentiated Services Code Points (DSCP) in NTP packets, simplifying configuration in large networks where different NTP implementations or versions are using different DSCP values. (BZ#1202828)

* This update adds the ability to configure separate clock stepping thresholds for each direction (backward and forward). Use the 'stepback' and 'stepfwd' options to configure each threshold.
(BZ#1193154)

* Support for nanosecond resolution has been added to the Structural Health Monitoring (SHM) reference clock. Prior to this update, when a Precision Time Protocol (PTP) hardware clock was used as a time source to synchronize the system clock, the accuracy of the synchronization was limited due to the microsecond resolution of the SHM protocol. The nanosecond extension in the SHM protocol now allows sub-microsecond synchronization of the system clock. (BZ#1117702)

All ntp users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message.(CVE-2017-6463)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is     enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage)     by sending (1) a spoofed crypto-NAK packet or (2) a     packet with an incorrect MAC value at a certain     time.(CVE-2016-4955)

  - The ntpq and ntpdc command-line utilities that are part     of ntp package are vulnerable to stack-based buffer     overflow via crafted hostname. Applications using these     vulnerable utilities with an untrusted input may be     potentially exploited, resulting in a crash or     arbitrary code execution under privileges of that     application.(CVE-2018-12327)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7     is enabled, allows remote attackers to cause a denial     of service (ntpd abort) by using the same IP address     multiple times in an unconfig directive.(CVE-2016-2516)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client     (A).(CVE-2015-7974)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.(CVE-2015-7701)

  - An out-of-bounds access flaw was found in the way ntpd     processed certain packets. An authenticated attacker     could use a crafted packet to create a peer association     with hmode of 7 and larger, which could potentially     (although highly unlikely) cause ntpd to     crash.(CVE-2016-2518)

  - A stack-based buffer overflow was found in the way the     NTP autokey protocol was implemented. When an NTP     client decrypted a secret received from an NTP server,     it could cause that client to crash.(CVE-2014-9750)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-7703)

  - A flaw was found in the way ntpd running on a host with     multiple network interfaces handled certain server     responses. A remote attacker could use this flaw which     would cause ntpd to not synchronize with the     source.(CVE-2016-7429)

  - A flaw was found in the way ntpd implemented the trap     service. A remote attacker could send a specially     crafted packet to cause a null pointer dereference that     will crash ntpd, resulting in a denial of     service.(CVE-2016-9311)

  - It was found that ntp-keygen used a weak method for     generating MD5 keys. This could possibly allow an     attacker to guess generated MD5 keys that could then be     used to spoof an NTP client or server. Note: it is     recommended to regenerate any MD5 keys that had     explicitly been generated with ntp-keygen the default     installation does not contain such keys.(CVE-2014-9294)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with     bad authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of     time.(CVE-2015-7979)

  - A flaw was found in the way ntpd calculated the root     delay. A remote attacker could send a specially-crafted     spoofed packet to cause denial of service or in some     special cases even crash.(CVE-2016-7433)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7691)

  - It was found that ntpd did not correctly implement the     threshold limitation for the '-g' option, which is used     to set the time without any restrictions. A     man-in-the-middle attacker able to intercept NTP     traffic between a connecting client and an NTP server     could use this flaw to force that client to make     multiple steps larger than the panic threshold,     effectively changing the time to an arbitrary value at     any time.(CVE-2015-5300)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by     the statistics or filegen configuration     command.(CVE-2015-5195)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash.(CVE-2015-7852)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers     to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast     packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548.(CVE-2016-4956)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash     ntpd.(CVE-2015-7978)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2231 advisory.

    - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)
    - allow only one step larger than panic threshold with -g (CVE-2015-5300)
    - validate lengths of values in extension fields (CVE-2014-9297)
    - drop packets with spoofed source address ::1 (CVE-2014-9298)
    - reject packets without MAC when authentication is enabled (CVE-2015-1798)
    - protect symmetric associations with symmetric key against DoS attack (CVE-2015-1799)
    - fix generation of MD5 keys with ntp-keygen on big-endian systems (CVE-2015-3405)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
87564	Scientific Linux 安全性更新 7.x x86_64 上的 ntp (2015:2231)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2025/8/29	high
81189	Debian DSA-3154-1：ntp - 安全性更新	Nessus	Debian Local Security Checks	2015/2/6	2021/1/11	medium
91539	Scientific Linux 安全性更新：SL6.x i386/x86_64 上的 ntp	Nessus	Scientific Linux Local Security Checks	2016/6/9	2021/1/14	high
84951	RHEL 6 : ntp (RHSA-2015:1459)	Nessus	Red Hat Local Security Checks	2015/7/23	2025/8/29	high
84951	RHEL 6：ntp (RHSA-2015:1459)	Nessus	Red Hat Local Security Checks	2015/7/23	2025/8/29	high
81189	Debian DSA-3154-1：ntp - 安全更新	Nessus	Debian Local Security Checks	2015/2/6	2021/1/11	medium
91539	Scientific Linux 安全更新：SL6.x (i386/x86_64) 中的 ntp	Nessus	Scientific Linux Local Security Checks	2016/6/9	2021/1/14	high
86773	F5 Networks BIG-IP : NTP vulnerabilities (K17530)	Nessus	F5 Networks Local Security Checks	2015/11/6	2019/1/4	high
87143	CentOS 7 : ntp (CESA-2015:2231)	Nessus	CentOS Local Security Checks	2015/12/2	2021/1/4	high
125009	EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1556)	Nessus	Huawei Local Security Checks	2019/5/14	2021/1/6	critical
87030	Oracle Linux 7 : ntp (ELSA-2015-2231)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2025/8/29	high

検出

プラグインの検索

high

medium

high

high

high

medium

high

high

high

critical

high