This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed :

  - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6     unauthenticated trap information disclosure and DDoS     vector.

  - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay     Prevention DoS.

  - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval     Enforcement DoS.

  - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero     Origin Timestamp Bypass.

  - CVE-2016-7434, bsc#1011398: NULL pointer dereference in
    _IO_str_init_static_internal().

  - CVE-2016-7429, bsc#1011404: Interface selection attack.

  - CVE-2016-7426, bsc#1011406: Client rate limiting and     server responses.

  - CVE-2016-7433, bsc#1011411: Reboot sync calculation     problem.

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).
    Non-security issues fixed :

  - Fix a spurious error message.

  - Other bugfixes, see     /usr/share/doc/packages/ntp/ChangeLog.

  - Fix a regression in 'trap' (bsc#981252).

  - Reduce the number of netlink groups to listen on for     changes to the local network setup (bsc#992606).

  - Fix segfault in 'sntp -a' (bsc#1009434).

  - Silence an OpenSSL version warning (bsc#992038).

  - Make the resolver task change user and group IDs to the     same values as the main task. (bsc#988028)

  - Simplify ntpd's search for its own executable to prevent     AppArmor warnings (bsc#956365).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't allow spoofed packets to demobilize associations     (CVE-2015-7979, CVE-2016-1547)

  - don't allow spoofed packet to enable symmetric     interleaved mode (CVE-2016-1548)

  - check mode of new source in config command     (CVE-2016-2518)

  - make MAC check resilient against timing attack     (CVE-2016-1550)

  - don't accept server/peer packets with zero origin     timestamp (CVE-2015-8138)

  - fix crash with reslist command (CVE-2015-7977,     CVE-2015-7978)

  - fix crash with invalid logconfig command (CVE-2015-5194)

  - fix crash when referencing disabled statistic type     (CVE-2015-5195)

  - don't hang in sntp with crafted reply (CVE-2015-5219)

  - don't crash with crafted autokey packet (CVE-2015-7691,     CVE-2015-7692, CVE-2015-7702)

  - fix memory leak with autokey (CVE-2015-7701)

  - don't allow setting driftfile and pidfile remotely     (CVE-2015-7703)

  - don't crash in ntpq with crafted packet (CVE-2015-7852)

  - add option to set Differentiated Services Code Point     (DSCP) (#1228314)

  - extend rawstats log (#1242895)

  - fix resetting of leap status (#1243034)

  - report clock state changes related to leap seconds     (#1242937)

  - allow -4/-6 on restrict lines with mask (#1232146)

  - retry joining multicast groups (#1288534)

  - explain synchronised state in ntpstat man page     (#1286969)

  - check origin timestamp before accepting KoD RATE packet     (CVE-2015-7704)

  - allow only one step larger than panic threshold with -g     (CVE-2015-5300)

The remote AIX host has a version of Network Time Protocol (NTP) installed that is affected by the following vulnerabilities :

  - A divide-by-zero error exists in file include/ntp.h     when handling LOGTOD and ULOGTOD macros in a crafted     NTP packet. An unauthenticated, remote attacker can     exploit this, via crafted NTP packets, to crash ntpd.
    (CVE 2015-5219)

  - A flaw exists in the ntp_crypto.c file due to improper     validation of the 'vallen' value in extension fields. An     unauthenticated, remote attacker can exploit this, via     specially crafted autokey packets, to disclose     sensitive information or cause a denial of service.
    (CVE-2015-7691)

  - A denial of service vulnerability exists in the autokey     functionality due to a failure in the crypto_bob2(),     crypto_bob3(), and cert_sign() functions to properly     validate the 'vallen' value. An unauthenticated, remote     attacker can exploit this, via specially crafted autokey     packets, to crash the NTP service. (CVE-2015-7692)

  - A denial of service vulnerability exists in the     crypto_recv() function in the file ntp_crypto.c related     to autokey functionality. An unauthenticated, remote     attacker can exploit this, via an ongoing flood of NTPv4     autokey requests, to exhaust memory resources.
    (CVE-2015-7701)

  - A denial of service vulnerability exists due to improper     validation of packets containing certain autokey     operations. An unauthenticated, remote attacker can     exploit this, via specially crafted autokey packets,     to crash the NTP service. (CVE-2015-7702)

  - A denial of service vulnerability exists due to a logic     flaw in the authreadkeys() function in the file     authreadkeys.c when handling extended logging where the     log and key files are set to be the same file. An     authenticated, remote attacker can exploit this, via a     crafted set of remote configuration requests, to cause     the NTP service to stop responding. (CVE-2015-7850)

  - A overflow condition exists in the     read_refclock_packet() function in the file ntp_io.c     when handling negative data lengths. A local attacker     can exploit this to crash the NTP service or possibly     gain elevated privileges. (CVE-2015-7853)

  - A denial of service vulnerability exists due to an     assertion flaw in the decodenetnum() function in the     file decodenetnum.c when handling long data values in     mode 6 and 7 packets. An unauthenticated, remote     attacker can exploit this to crash the NTP service.
    (CVE-2015-7855)

The remote Fedora 22 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-14212 advisory.

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-0780 advisory.

    - don't accept server/peer packets with zero origin timestamp (CVE-2015-8138)
    - fix crash with reslist command (CVE-2015-7977, CVE-2015-7978)
    - fix crash with invalid logconfig command (CVE-2015-5194)
    - fix crash when referencing disabled statistic type (CVE-2015-5195)
    - don't hang in sntp with crafted reply (CVE-2015-5219)
    - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692,       CVE-2015-7702)
    - fix memory leak with autokey (CVE-2015-7701)
    - don't allow setting driftfile and pidfile remotely (CVE-2015-7703)
    - don't crash in ntpq with crafted packet (CVE-2015-7852)
    - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues :

Also yast2-ntp-client was updated to match some sntp syntax changes.
(bsc#937837)

Major functional changes :

  - The 'sntp' commandline tool changed its option handling     in a major way.

  - 'controlkey 1' is added during update to ntp.conf to     allow sntp to work.

  - The local clock is being disabled during update.

  - ntpd is no longer running chrooted.

Other functional changes :

  - ntp-signd is installed.

  - 'enable mode7' can be added to the configuration to     allow ntdpc to work as compatibility mode option.

  - 'kod' was removed from the default restrictions.

  - SHA1 keys are used by default instead of MD5 keys.

These security issues were fixed :

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).

  - CVE-2015-8158: Fixed potential infinite loop in ntpq     (bsc#962966).

  - CVE-2015-8138: Zero Origin Timestamp Bypass     (bsc#963002).

  - CVE-2015-7979: Off-path Denial of Service (DoS) attack     on authenticated broadcast mode (bsc#962784).

  - CVE-2015-7978: Stack exhaustion in recursive traversal     of restriction list (bsc#963000).

  - CVE-2015-7977: reslist NULL pointer dereference     (bsc#962970).

  - CVE-2015-7976: ntpq saveconfig command allows dangerous     characters in filenames (bsc#962802).

  - CVE-2015-7975: nextvar() missing length check     (bsc#962988).

  - CVE-2015-7974: Skeleton Key: Missing key check allows     impersonation between authenticated peers (bsc#962960).

  - CVE-2015-7973: Replay attack on authenticated broadcast     mode (bsc#962995).

  - CVE-2015-8140: ntpq vulnerable to replay attacks     (bsc#962994).

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin (bsc#962997).

  - CVE-2015-5300: MITM attacker could have forced ntpd to     make a step larger than the panic threshold     (bsc#951629).

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK (bsc#951608).

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values (bsc#951608).

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow     (bsc#951608).

  - CVE-2015-7852: ntpq atoascii() Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7851: saveconfig Directory Traversal     Vulnerability (bsc#951608).

  - CVE-2015-7850: remote config logfile-keyfile     (bsc#951608).

  - CVE-2015-7849: trusted key use-after-free (bsc#951608).

  - CVE-2015-7848: mode 7 loop counter underrun     (bsc#951608).

  - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC     (bsc#951608).

  - CVE-2015-7703: configuration directives 'pidfile' and     'driftfile' should only be allowed locally (bsc#951608).

  - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD     should validate the origin timestamp field (bsc#951608).

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete     autokey data packet length checks (bsc#951608).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2583 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time     source. These packages include the ntpd service which continuously adjusts system time and utilities used     to query and configure the ntpd service.

    Security Fix(es):

    * It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious     data was not always being completely validated. A remote attacker could use a specially crafted NTP packet     to crash ntpd. (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

    * A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey     authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack,     cause it to run out of memory. (CVE-2015-7701)

    * An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A     specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

    * A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could potentially use this     flaw to crash ntpd. (CVE-2015-7977)

    * A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that     queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash     ntpd. (CVE-2015-7978)

    * It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets     with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the     association with the broadcast server, causing them to become out of sync over a longer period of time.
    (CVE-2015-7979)

    * It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig     configuration commands. (CVE-2015-5194)

    * It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by the statistics or filegen configuration command.
    (CVE-2015-5195)

    * It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock     (in hourly intervals). (CVE-2015-5196, CVE-2015-7703)

    * It was discovered that the sntp utility could become unresponsive due to being caught in an infinite     loop when processing a crafted NTP packet. (CVE-2015-5219)

    * A flaw was found in the way NTP verified trusted keys during symmetric key authentication. An     authenticated client (A) could use this flaw to modify a packet sent between a server (B) and a client (C)     using a key that is different from the one known to the client (A). (CVE-2015-7974)

    * A flaw was found in the way the ntpq client processed certain incoming packets in a loop in the     getresponse() function. A remote attacker could potentially use this flaw to crash an ntpq client     instance. (CVE-2015-8158)

    The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed :

  - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6     unauthenticated trap information disclosure and DDoS     vector.

  - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay     Prevention DoS.

  - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval     Enforcement DoS.

  - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero     Origin Timestamp Bypass.

  - CVE-2016-7434, bsc#1011398: NULL pointer dereference in
    _IO_str_init_static_internal().

  - CVE-2016-7429, bsc#1011404: Interface selection attack.

  - CVE-2016-7426, bsc#1011406: Client rate limiting and     server responses.

  - CVE-2016-7433, bsc#1011411: Reboot sync calculation     problem.

  - CVE-2015-8140: ntpq vulnerable to replay attacks.

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin.

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).
    Non-security issues fixed :

  - Fix a spurious error message.

  - Other bugfixes, see     /usr/share/doc/packages/ntp/ChangeLog.

  - Fix a regression in 'trap' (bsc#981252).

  - Reduce the number of netlink groups to listen on for     changes to the local network setup (bsc#992606).

  - Fix segfault in 'sntp -a' (bsc#1009434).

  - Silence an OpenSSL version warning (bsc#992038).

  - Make the resolver task change user and group IDs to the     same values as the main task. (bsc#988028)

  - Simplify ntpd's search for its own executable to prevent     AppArmor warnings (bsc#956365).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
95987	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:3195-1)	Nessus	SuSE Local Security Checks	2016/12/21	2026/1/7	medium
91419	OracleVM 3.3 / 3.4 : ntp (OVMSA-2016-0082)	Nessus	OracleVM Local Security Checks	2016/6/1	2021/1/4	high
102321	AIX NTP v3 Advisory : ntp_advisory4.asc (IV79942) (IV79943) (IV79944) (IV79945) (IV79946)	Nessus	AIX Local Security Checks	2017/8/9	2025/12/2	critical
86331	Fedora 22 : ntp (2015-14212)	Nessus	Fedora Local Security Checks	2015/10/12	2025/8/29	high
91151	Oracle Linux 6 : ntp (ELSA-2016-0780)	Nessus	Oracle Linux Local Security Checks	2016/5/16	2024/10/22	high
91248	SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1311-1)	Nessus	SuSE Local Security Checks	2016/5/19	2021/1/19	critical
94546	RHEL 7 : ntp (RHSA-2016:2583)	Nessus	Red Hat Local Security Checks	2016/11/4	2025/8/29	high
96715	SUSE SLES11 Security Update : ntp (SUSE-SU-2017:0255-1)	Nessus	SuSE Local Security Checks	2017/1/24	2026/1/5	medium

検出

プラグインの検索

medium

high

critical

high

high

critical

high

medium