This update for ntp fixes the following issues :

  - Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

  - Don't use libevent's cached time stamps in sntp.
    (bsc#1077445)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ntp fixes the following issues :

  - Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

  - Don't use libevent's cached time stamps in sntp.
    (bsc#1077445) This update is a reissue of the previous     update with LTSS channels included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ntp fixes the following issues :

Update to 4.2.8p11 (bsc#1082210) :

  - CVE-2016-1549: Sybil vulnerability: ephemeral     association attack. While fixed in ntp-4.2.8p7, there     are significant additional protections for this issue in     4.2.8p11.

  - CVE-2018-7182: ctl_getitem(): buffer read overrun leads     to undefined behavior and information leak.
    (bsc#1083426)

  - CVE-2018-7170: Multiple authenticated ephemeral     associations. (bsc#1083424)

  - CVE-2018-7184: Interleaved symmetric mode cannot recover     from bad state. (bsc#1083422)

  - CVE-2018-7185: Unauthenticated packet can reset     authenticated interleaved association. (bsc#1083420)

  - CVE-2018-7183: ntpq:decodearr() can write beyond its     buffer limit.(bsc#1083417)

Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private     symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of     ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for     CVE-2016-1549. (CVE-2018-7170)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for NTP to version 4.2.8p12 fixes the following vulnerabilities (bsc#1111853) :

  - CVE-2018-12327: Fixed stack-based buffer overflow in the     openhost() command-line call of NTPQ/NTPDC.
    (bsc#1098531)

  - CVE-2018-7170: Add further tweaks to improve the fix for     the ephemeral association time spoofing additional     protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

NTP was updated to 4.2.8p12 (bsc#1111853) :

  - CVE-2018-12327: Fixed stack-based buffer overflow in the     openhost() command-line call of NTPQ/NTPDC.
    (bsc#1098531)

  - CVE-2018-7170: Add further tweaks to improve the fix for     the ephemeral association time spoofing additional     protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

This update was imported from the SUSE:SLE-15:Update update project.

New ntp packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

ntpd in ntp 4.2.x before 4.2.8p7 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549 .(CVE-2018-7170)

The ntpq and ntpdc command-line utilities that are part of ntp package are vulnerable to stack-based buffer overflow via crafted hostname.
Applications using these vulnerable utilities with an untrusted input may be potentially exploited, resulting in a crash or arbitrary code execution under privileges of that application.(CVE-2018-12327)

NTP was updated to 4.2.8p12 (bsc#1111853) :

CVE-2018-12327: Fixed stack-based buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)

CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2018-12327 and fixed fix for CVE-2018-7170.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109085	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:0956-1)	Nessus	SuSE Local Security Checks	2018/4/17	2024/10/31	critical
110639	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:1765-1)	Nessus	SuSE Local Security Checks	2018/6/21	2024/9/17	critical
118269	SUSE SLES12 Security Update : ntp (SUSE-SU-2018:1765-2)	Nessus	SuSE Local Security Checks	2018/10/22	2024/7/30	critical
222620	Linux Distros Unpatched Vulnerability : CVE-2018-7170	Nessus	Misc.	2025/3/4	2026/8/25	medium
118450	openSUSE Security Update : ntp (openSUSE-2018-1280)	Nessus	SuSE Local Security Checks	2018/10/26	2024/7/29	critical
123357	openSUSE Security Update : ntp (openSUSE-2019-856)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/10	critical
107103	Slackware 14.0 / 14.1 / 14.2 / current : ntp (SSA:2018-060-02)	Nessus	Slackware Local Security Checks	2018/3/2	2025/10/27	medium
117607	Amazon Linux AMI : ntp (ALAS-2018-1083)	Nessus	Amazon Linux Local Security Checks	2018/9/20	2024/8/6	critical
118352	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2018:3342-1)	Nessus	SuSE Local Security Checks	2018/10/24	2024/7/29	critical
118445	openSUSE Security Update : ntp (openSUSE-2018-1275)	Nessus	SuSE Local Security Checks	2018/10/26	2024/7/29	critical
120864	Fedora 28 : ntp (2018-e585e25b72)	Nessus	Fedora Local Security Checks	2019/1/3	2024/6/28	critical

检测

插件搜索

critical

critical

critical

medium

critical

critical

medium

critical

critical

critical

critical