远程 AIX 主机上安装的 NTP 版本受到下列漏洞影响：- 由于未正确验证 ntp.conf 文件的特定输入，文件 ntpd/ntp_control.c 的 ctl_putdata() 函数周围的各种包装函数中存在多个基于堆栈的缓冲区溢出情况。未经身份验证的远程攻击者可利用这些问题，通过诱骗用户部署特制的 ntp.conf 文件，造成拒绝服务情况或可能的任意代码执行。(CVE-2017-6458) - 处理 ‘/dev/datum’ 设备的数据包时，由于未正确验证特定输入，文件 ntpd/refclock_datum.c 的 datum_pts_receive() 函数中存在基于堆栈的缓冲区溢出情况。本地攻击者可利用此问题，造成拒绝服务或执行任意代码。(CVE-2017-6462) - 处理配置指令时，存在拒绝服务漏洞。经身份验证的远程攻击者可利用此问题，通过畸形 ‘mode’ 配置指令，造成 ntpd 后台程序崩溃。(CVE-2017-6464)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has ntp packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message. (CVE-2017-6463,     CVE-2017-6464)

  - A vulnerability was found in NTP, in the parsing of     packets from the /dev/datum device. A malicious device     could send crafted messages, causing ntpd to crash.
    (CVE-2017-6462)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 4.05, has ntp packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in NTP, in the parsing of     packets from the /dev/datum device. A malicious device     could send crafted messages, causing ntpd to crash.
    (CVE-2017-6462)

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message. (CVE-2017-6463,     CVE-2017-6464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the ntp packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - The Network Time Protocol (NTP) is used to synchronize     a computer's time with another reference time source.
    This package includes ntpd (a daemon which continuously     adjusts system time) and utilities used to query and     configure the ntpd daemon. Perl scripts ntp-wait and     ntptrace are in the ntp-perl package, ntpdate is in the     ntpdate package and sntp is in the sntp package. The     documentation is in the ntp-doc package. Security     Fix(es):NTP through 4.2.8p12 has a NULL Pointer     Dereference.(CVE-2019-8936)Buffer overflow in the     legacy Datum Programmable Time Server (DPTS) refclock     driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94     allows local users to have unspecified impact via a     crafted /dev/datum device.(CVE-2017-6462)NTP before     4.2.8p10 and 4.3.x before 4.3.94 allows remote     attackers to cause a denial of service (ntpd crash) via     a malformed mode configuration     directive.(CVE-2017-6464)NTP before 4.2.8p10 and 4.3.x     before 4.3.94 allows remote authenticated users to     cause a denial of service (daemon crash) via an invalid     setting in a :config directive, related to the unpeer     option.(CVE-2017-6463)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the ntp package has been released.

According to the versions of the ntp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - ntpq in NTP before 4.2.8p7 allows remote attackers to     obtain origin timestamps and then impersonate peers via     unspecified vectors.(CVE-2015-8139)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7     is enabled, allows remote attackers to cause a denial     of service (ntpd abort) by using the same IP address     multiple times in an unconfig directive.(CVE-2016-2516)

  - The process_packet function in ntp_proto.c in ntpd in     NTP 4.x before 4.2.8p8 allows remote attackers to cause     a denial of service (peer-variable modification) by     sending spoofed packets from many source IP addresses     in a certain scenario, as demonstrated by triggering an     incorrect leap indication.(CVE-2016-4954)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is     enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage)     by sending (1) a spoofed crypto-NAK packet or (2) a     packet with an incorrect MAC value at a certain     time.(CVE-2016-4955)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers     to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast     packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548.(CVE-2016-4956)

  - Buffer overflow in the legacy Datum Programmable Time     Server (DPTS) refclock driver in NTP before 4.2.8p10     and 4.3.x before 4.3.94 allows local users to have     unspecified impact via a crafted /dev/datum     device.(CVE-2017-6462)

  - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows     remote authenticated users to cause a denial of service     (daemon crash) via an invalid setting in a :config     directive, related to the unpeer option.(CVE-2017-6463)

  - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows     remote attackers to cause a denial of service (ntpd     crash) via a malformed mode configuration     directive.(CVE-2017-6464)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution     (CVE-2018-12327)

  - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a     denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1     requests, as exploited in the wild in December 2013. (CVE-2013-5211)

  - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a     GET_RESTRICT control message, which could let a malicious user obtain sensitive information.
    (CVE-2014-5209)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This ntp update to version 4.2.8p10 fixes serveral issues. This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details. Security issues fixed (bsc#1030050) :

  - CVE-2017-6464: Denial of Service via Malformed Config

  - CVE-2017-6462: Buffer Overflow in DPTS Clock

  - CVE-2017-6463: Authenticated DoS via Malicious Config     Option

  - CVE-2017-6458: Potential Overflows in ctl_put()     functions

  - CVE-2017-6451: Improper use of snprintf() in     mx4200_send()

  - CVE-2017-6460: Buffer Overflow in ntpq when fetching     reslist

  - CVE-2016-9042: 0rigin (zero origin) DoS.

  - ntpq_stripquotes() returns incorrect Value

  - ereallocarray()/eallocarray() underused

  - Copious amounts of Unused Code

  - Off-by-one in Oncore GPS Receiver

  - Makefile does not enforce Security Flags Bugfixes :

  - Remove spurious log messages (bsc#1014172).

  - clang scan-build findings

  - Support for openssl-1.1.0 without compatibility modes

  - Bugfix 3072 breaks multicastclient

  - forking async worker: interrupted pipe I/O

  - (...) time_pps_create: Exec format error

  - Incorrect Logic for Peer Event Limiting

  - Change the process name of forked DNS worker

  - Trap Configuration Fail

  - Nothing happens if minsane 

  - allow -4/-6 on restrict line with mask

  - out-of-bound pointers in ctl_putsys and decode_bitflags

  - Move ntp-kod to /var/lib/ntp, because /var/db is not a     standard directory and causes problems for transactional     updates.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denial of Service via Malformed Config :

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message.(CVE-2017-6464)

Potential Overflows in ctl_put() functions :

A vulnerability was found in NTP, in the building of response packets with custom fields. If custom fields were configured in ntp.conf with particularly long names, inclusion of these fields in the response packet could cause a buffer overflow, leading to a crash.
(CVE-2017-6458)

Improper use of snprintf() in mx4200_send() :

A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution.(CVE-2017-6451)

Authenticated DoS via Malicious Config Option :

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message.(CVE-2017-6463)

Buffer Overflow in DPTS Clock :

A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash.(CVE-2017-6462)

The remote host is running a version of macOS that is prior to 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

 - Apache
 - AppSandbox
 - AppleScript
 - Application Firewall
 - ATS
 - Audio
 - CFNetwork
 - CFNetwork Proxies
 - CFString
 - Captive Network Assistant
 - CoreAudio
 - CoreText
 - DesktopServices
 - Directory Utility
 - file
 - Fonts
 - fsck_msdos
 - HFS
 - Heimdal
 - HelpViewer
 - IOFireWireFamily
 - ImageIO
 - Installer
 - Kernel
 - kext tools
 - libarchive
 - libc
 - libexpat
 - Mail
 - Mail Drafts
 - ntp
 - Open Scripting Architecture
 - PCRE
 - Postfix
 - Quick Look
 - QuickTime
 - Remote Management
 - SQLite
 - Sandbox
 - Screen Lock
 - Security
 - Spotlight
 - WebKit
 - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
102131	AIX NTP v4 公告：ntp_advisory9.asc (IV96311) (IV96312)	Nessus	AIX Local Security Checks	2017/8/3	2023/4/21	high
127193	NewStart CGSL CORE 5.04 / MAIN 5.04 : ntp Multiple Vulnerabilities (NS-SA-2019-0029)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
127378	NewStart CGSL MAIN 4.05 : ntp Multiple Vulnerabilities (NS-SA-2019-0127)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
128941	EulerOS Virtualization for ARM 64 3.0.2.0 : ntp (EulerOS-SA-2019-1938)	Nessus	Huawei Local Security Checks	2019/9/17	2024/4/25	high
121678	Photon OS 1.0: Ntp PHSA-2017-0010	Nessus	PhotonOS Local Security Checks	2019/2/7	2022/5/24	high
101311	EulerOS 2.0 SP2 : ntp (EulerOS-SA-2017-1125)	Nessus	Huawei Local Security Checks	2017/7/10	2021/1/6	medium
198530	RHEL 5 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	2024/6/3	2024/6/3	critical
99468	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2017:1048-1)	Nessus	SuSE Local Security Checks	2017/4/19	2021/1/6	high
99529	Amazon Linux AMI : ntp (ALAS-2017-816)	Nessus	Amazon Linux Local Security Checks	2017/4/21	2018/4/18	high
700511	macOS < 10.13 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical

検出

プラグインの検索

high

high

high

high

high

medium

critical

high

high

critical