Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(), ctl_putdata(), and configure() functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user. Note: the crypto_recv() flaw requires non- default configurations to be active, while the ctl_putdata() flaw, by default, can only be exploited via local attackers, and the configure() flaw requires additional authentication to exploit. (CVE-2014-9295)

It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests. (CVE-2014-9293)

It was found that ntp-keygen used a weak method for generating MD5 keys. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. Note:
it is recommended to regenerate any MD5 keys that had explicitly been generated with ntp-keygen; the default installation does not contain such keys). (CVE-2014-9294)

A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism.
(CVE-2014-9296)

After installing the update, the ntpd daemon will restart automatically.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2449-1 advisory.

    Neel Mehta discovered that NTP generated weak authentication keys. A remote attacker could possibly use     this issue to brute force the authentication key and send requests if permitted by IP restrictions.
    (CVE-2014-9293)

    Stephen Roettger discovered that NTP generated weak MD5 keys. A remote attacker could possibly use this     issue to brute force the MD5 key and spoof a client or server. (CVE-2014-9294)

    Stephen Roettger discovered that NTP contained buffer overflows in the crypto_recv(), ctl_putdata() and     configure() functions. In non-default configurations, a remote attacker could use these issues to cause     NTP to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler     options for affected releases should reduce the vulnerability to a denial of service. In addition,     attackers would be isolated by the NTP AppArmor profile. (CVE-2014-9295)

    Stephen Roettger discovered that NTP incorrectly continued processing when handling certain errors.
    (CVE-2014-9296)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated ntp packages fix security vulnerabilities :

If no authentication key is defined in the ntp.conf file, a cryptographically-weak default key is generated (CVE-2014-9293).

ntp-keygen before 4.2.7p230 uses a non-cryptographic random number generator with a weak seed to generate symmetric keys (CVE-2014-9294).

A remote unauthenticated attacker may craft special packets that trigger buffer overflows in the ntpd functions crypto_recv() (when using autokey authentication), ctl_putdata(), and configure(). The resulting buffer overflows may be exploited to allow arbitrary malicious code to be executed with the privilege of the ntpd process (CVE-2014-9295).

A section of code in ntpd handling a rare error is missing a return statement, therefore processing did not stop when the error was encountered. This situation may be exploitable by an attacker (CVE-2014-9296).

The ntp package has been patched to fix these issues.

Several vulnerabilities were discovered in the ntp package, an implementation of the Network Time Protocol.

CVE-2014-9293

ntpd generated a weak key for its internal use, with full administrative privileges. Attackers could use this key to reconfigure ntpd (or to exploit other vulnerabilities).

CVE-2014-9294

The ntp-keygen utility generated weak MD5 keys with insufficient entropy.

CVE-2014-9295

ntpd had several buffer overflows (both on the stack and in the data section), allowing remote authenticated attackers to crash ntpd or potentially execute arbitrary code.

CVE-2014-9296

The general packet processing function in ntpd did not handle an error case correctly.

The default ntpd configuration in Debian restricts access to localhost (and possible the adjacent network in case of IPv6).

Keys explicitly generated by 'ntp-keygen -M' should be regenerated.

For the oldstable distribution (squeeze), these problems have been fixed in version 4.2.6.p2+dfsg-1+deb6u1.

We recommend that you upgrade your heirloom-mailx packages.

Thanks to the Florian Weimer for the Red Hat security update.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't generate weak control key for resolver     (CVE-2014-9293)

  - don't generate weak MD5 keys in ntp-keygen     (CVE-2014-9294)

  - fix buffer overflows via specially-crafted packets     (CVE-2014-9295)

  - don't mobilize passive association when authentication     fails (CVE-2014-9296)

Security fix for CVE-2014-9294, CVE-2014-9295, CVE-2014-9293, CVE-2014-9296

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Cisco device is running a version of IOS XR software that is affected by the following vulnerabilities :

  - Errors exist related to weak cryptographic pseudorandom     number generation (PRNG), the functions 'ntp_random' and     and 'config_auth', and the 'ntp-keygen' utility. A     man-in-the-middle attacker can exploit these to disclose     sensitive information. (CVE-2014-9293, CVE-2014-9294)

  - Multiple stack-based buffer overflow errors exist in the     Network Time Protocol daemon (ntpd), which a remote     attacker can exploit to execute arbitrary code or cause     a denial of service by using a specially crafted packet.
    (CVE-2014-9295)

  - An error exists in the 'receive' function in the Network     Time Protocol daemon (ntpd) that allows denial of     service attacks. (CVE-2014-9296)

The version of the remote NTP server is 4.x prior to 4.2.8p1. It is, therefore, affected by the following vulnerabilities :

  - A security weakness exists due to the config_auth()     function improperly generating default keys when no     authentication key is defined in the ntp.conf file.
    Key size is limited to 31 bits and the insecure     ntp_random() function is used, resulting in     cryptographically-weak keys with insufficient entropy. A     remote attacker can exploit this to defeat cryptographic     protection mechanisms via a brute-force attack.
    (CVE-2014-9293)

  - A security weakness exists due the use of a weak seed to     prepare a random number generator used to generate     symmetric keys. This allows a remote attacker to defeat     cryptographic protection mechanisms via a brute-force     attack. (CVE-2014-9294)

  - Multiple stack-based buffer overflow conditions exist     due to improper validation of user-supplied input when     handling packets in the crypto_recv(), ctl_putdata(),     and configure() functions when using autokey     authentication. A remote attacker can exploit this, via     a specially crafted packet, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2014-9295)

  - A unspecified vulnerability exists due to missing return     statements in the receive() function, resulting in     continued processing even when an authentication error     is encountered. This allows a remote attacker, via     specially crafted packets, to trigger unintended     association changes. (CVE-2014-9296)

  - An information disclosure vulnerability exists due to     improper validation of the 'vallen' value in extension     fields in ntp_crypto.c. A remote attacker can exploit     this to disclose sensitive information. (CVE-2014-9750)

  - A security bypass vulnerability exists due to a failure     to restrict ::1 source addresses on IPv6 interfaces. A     remote attacker can exploit this to bypass configured     ACLs based on ::1. (CVE-2014-9751)

Note that CVE-2014-9750 and CVE-2014-9751 supersede the discontinued identifiers CVE-2014-9297 and CVE-2014-9298, which were originally cited in the vendor advisory.

s700_800 11.23 NTP timeservices upgrade plus utilities : 

Potential security vulnerabilities have been identified with HP-UX running NTP. These could be exploited remotely to execute code, create a Denial of Service (DoS), or other vulnerabilities. References:
CVE-2014-9293 - Insufficient Entropy in Pseudo-Random Number Generator (PRNG) (CWE-332) CVE-2014-9294 - Use of Cryptographically Weak PRNG (CWE-338) CVE-2014-9295 - Stack Buffer Overflow (CWE-121) CVE-2014-9296 - Error Conditions, Return Values, Status Codes (CWE-389) CVE-2014-9297 - Improper Check for Unusual or Exceptional Conditions (CWE-754) SSRT101872 VU#852879.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that ntpd did not check whether a Message     Authentication Code (MAC) was present in a received     packet when ntpd was configured to use symmetric     cryptographic keys. A man-in-the-middle attacker could     use this flaw to send crafted packets that would be     accepted by a client or a peer without the attacker     knowing the symmetric key.(CVE-2015-1798)

  - A missing return statement in the receive() function     could potentially allow a remote attacker to bypass     NTP's authentication mechanism.(CVE-2014-9296)

  - The rate limiting feature in NTP 4.x before 4.2.8p4 and     4.3.x before 4.3.77 allows remote attackers to have     unspecified impact via a large number of crafted     requests.(CVE-2015-7705)

  - The datalen parameter in the refclock driver in NTP     4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows     remote attackers to execute arbitrary code or cause a     denial of service (crash) via a negative input     value.(CVE-2015-7853)

  - Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4,     and 4.3.x before 4.3.77 allows remote attackers to     bypass authentication.(CVE-2015-7871)

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows     a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a     zero-origin timestamp and source IP address of the     ''other side'' of an interleaved association causing     the victim ntpd to reset its     association.(CVE-2018-7185)

  - The ntpq saveconfig command in NTP 4.1.2, 4.2.x before     4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not     properly filter special characters, which allows     attackers to cause unspecified impact via a crafted     filename.(CVE-2015-7976)

  - ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before     4.3.77 allows remote authenticated users to cause a     denial of service (infinite loop or crash) by pointing     the key file at the log file.(CVE-2015-7850)

  - The decodenetnum function in ntpd in NTP 4.2.x before     4.2.8p4, and 4.3.x before 4.3.77 allows remote     attackers to cause a denial of service (assertion     failure) via a 6 or mode 7 packet containing a long     data value.(CVE-2015-7855)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CERT reports :

The Network Time Protocol (NTP) provides networked systems with a way to synchronize time for various services and applications. ntpd version 4.2.7 and previous versions allow attackers to overflow several buffers in a way that may allow malicious code to be executed.
ntp-keygen prior to version 4.2.7p230 also uses a non-cryptographic random number generator when generating symmetric keys.

The buffer overflow vulnerabilities in ntpd may allow a remote unauthenticated attacker to execute arbitrary malicious code with the privilege level of the ntpd process. The weak default key and non-cryptographic random number generator in ntp-keygen may allow an attacker to gain information regarding the integrity checking and authentication encryption schemes.

It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests. (CVE-2014-9293)

It was found that ntp-keygen used a weak method for generating MD5 keys. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. Note:
it is recommended to regenerate any MD5 keys that had explicitly been generated with ntp-keygen; the default installation does not contain such keys). (CVE-2014-9294)

Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(), ctl_putdata(), and configure() functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user. Note: the crypto_recv() flaw requires non default configurations to be active, while the ctl_putdata() flaw, by default, can only be exploited via local attackers, and the configure() flaw requires additional authentication to exploit. (CVE-2014-9295)

A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism.
(CVE-2014-9296)

Updated ntp packages that fix several security issues are now available for Red Hat Enterprise Linux 6.5 Extended Update Support.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(), ctl_putdata(), and configure() functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user. Note: the crypto_recv() flaw requires non-default configurations to be active, while the ctl_putdata() flaw, by default, can only be exploited via local attackers, and the configure() flaw requires additional authentication to exploit. (CVE-2014-9295)

It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests. (CVE-2014-9293)

It was found that ntp-keygen used a weak method for generating MD5 keys. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. Note:
it is recommended to regenerate any MD5 keys that had explicitly been generated with ntp-keygen; the default installation does not contain such keys. (CVE-2014-9294)

A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism.
(CVE-2014-9296)

All ntp users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. After installing the update, the ntpd daemon will restart automatically.

According to its self-reported version number, the version of Cisco Prime Security Manager running on the remote host is prior to 9.3.3.2.
It is, therefore, affected by multiple vulnerabilities in the bundled NTP libraries :

  - A security weakness exists due to the config_auth()     function improperly generating default keys when no     authentication key is defined in the 'ntp.conf' file.
    Key size is limited to 31 bits and the insecure     ntp_random() function is used, resulting in     cryptographically-weak keys with insufficient entropy.
    This allows a remote attacker to defeat cryptographic     protection mechanisms via a brute-force attack.
    (CVE-2014-9293)

  - A security weakness exists due the use of a weak seed     to prepare a random number generator used to generate     symmetric keys. This allows remote attackers to defeat     cryptographic protection mechanisms via a brute-force     attack. (CVE-2014-9294)

  - Multiple stack-based buffer overflows exist due to     improperly validated user-supplied input when handling     packets in the crypto_recv(), ctl_putdata(), and     configure() functions when using autokey authentication.
    This allows a remote attacker, via a specially crafted     packet, to cause a denial of service condition or     execute arbitrary code. (CVE-2014-9295)

  - A unspecified vulnerability exists due to missing return     statements in the receive() function, resulting in     continued processing even when an authentication error     is encountered. This allows a remote attacker, via     crafted packets, to trigger unintended association     changes. (CVE-2014-9296)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80164	Scientific Linux Security Update : ntp on SL6.x, SL7.x i386/x86_64 (20141220)	Nessus	Scientific Linux Local Security Checks	2014/12/22	2021/1/14	high
80218	Ubuntu 14.04 LTS : NTP vulnerabilities (USN-2449-1)	Nessus	Ubuntu Local Security Checks	2014/12/23	2024/8/28	medium
80384	Mandriva Linux Security Advisory : ntp (MDVSA-2015:003)	Nessus	Mandriva Local Security Checks	2015/1/6	2021/1/6	high
82099	Debian DLA-116-1 : ntp security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	high
80248	OracleVM 3.3 : ntp (OVMSA-2014-0085)	Nessus	OracleVM Local Security Checks	2014/12/26	2021/1/4	high
80310	Fedora 19 : ntp-4.2.6p5-13.fc19 (2014-17395)	Nessus	Fedora Local Security Checks	2015/1/2	2021/1/11	high
81912	Cisco IOS XR Multiple ntpd Vulnerabilities	Nessus	CISCO	2015/3/18	2021/4/8	high
81913	Cisco IOS XR NCS 6000 Multiple ntpd Vulnerabilities	Nessus	CISCO	2015/3/18	2021/4/8	high
81981	Network Time Protocol Daemon (ntpd) 4.x < 4.2.8p1 Multiple Vulnerabilities	Nessus	Misc.	2015/3/20	2018/7/16	critical
82683	HP-UX PHNE_44236 : s700_800 11.23 NTP timeservices upgrade plus utilities	Nessus	HP-UX Local Security Checks	2015/4/10	2021/1/11	high
125010	EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1557)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
80149	FreeBSD : ntp -- multiple vulnerabilities (4033d826-87dd-11e4-9079-3c970e169bc2)	Nessus	FreeBSD Local Security Checks	2014/12/22	2021/1/6	high
80237	Fedora 21 : ntp-4.2.6p5-25.fc21 (2014-17367)	Nessus	Fedora Local Security Checks	2014/12/26	2021/1/11	high
80122	Amazon Linux AMI : ntp (ALAS-2014-462)	Nessus	Amazon Linux Local Security Checks	2014/12/22	2018/4/18	high
80147	Fedora 20 : ntp-4.2.6p5-19.fc20 (2014-17361)	Nessus	Fedora Local Security Checks	2014/12/22	2021/1/11	high
81071	RHEL 6 : ntp (RHSA-2015:0104)	Nessus	Red Hat Local Security Checks	2015/1/29	2019/10/24	high
81980	Cisco Prime Security Manager Network Time Protocol Daemon (ntpd) Multiple Vulnerabilities (cisco-sa-20141222-ntpd)	Nessus	CGI abuses	2015/3/20	2021/1/19	high

检测

插件搜索

high

medium

high

high

high

high

high

high

critical

high

critical

high

high

high

high

high

high