The remote Fedora 22 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-14212 advisory.

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 21 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2015-77bfbc1bcd advisory.

    Security fix for CVE-2015-7704, CVE-2015-5300, CVE-2015-7692, CVE-2015-7871, CVE-2015-7702, CVE-2015-7691,     CVE-2015-7852, CVE-2015-7701

    ----

    Security fix for CVE-2015-5146, CVE-2015-5194, CVE-2015-5219, CVE-2015-5195, CVE-2015-5196

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a     precision value to a double, which allows remote attackers to cause a denial of service (infinite loop)     via a crafted NTP packet. (CVE-2015-5219)

Note that Nessus relies on the presence of the package as reported by the vendor.

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs :

  - CVE-2015-5146     A flaw was found in the way ntpd processed certain     remote configuration packets. An attacker could use a     specially crafted package to cause ntpd to crash if :

    - ntpd enabled remote configuration
    - The attacker had the knowledge of the configuration       password

    - The attacker had access to a computer entrusted to       perform remote configuration

      Note that remote configuration is disabled by default       in NTP.

  - CVE-2015-5194     It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.

  - CVE-2015-5195     It was found that ntpd exits with a segmentation fault     when a statistics type that was not enabled during     compilation (e.g. timingstats) is referenced by the     statistics or filegen configuration command.

  - CVE-2015-5219     It was discovered that sntp program would hang in an     infinite loop when a crafted NTP packet was received,     related to the conversion of the precision value in the     packet to double.

  - CVE-2015-5300     It was found that ntpd did not correctly implement the
    -g option :

  Normally, ntpd exits with a message to the system log if the offset   exceeds the panic threshold, which is 1000 s by default. This option   allows the time to be set to any value without restriction; however,   this can happen only once. If the threshold is exceeded after that,   ntpd will exit with a message to the system log. This option can be   used with the -q and -x options.

  ntpd could actually step the clock multiple times by more than the   panic threshold if its clock discipline doesn't have enough time to   reach the sync state and stay there for at least one update. If a   man-in-the-middle attacker can control the NTP traffic since ntpd   was started (or maybe up to 15-30 minutes after that), they can   prevent the client from reaching the sync state and force it to step   its clock by any amount any number of times, which can be used by   attackers to expire certificates, etc.

  This is contrary to what the documentation says. Normally, the   assumption is that an MITM attacker can step the clock more than the   panic threshold only once when ntpd starts and to make a larger   adjustment the attacker has to divide it into multiple smaller   steps, each taking 15 minutes, which is slow.

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702     It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in ntp_crypto.c, where a packet with particular     autokey operations that contained malicious data was not     always being completely validated. Receipt of these     packets can cause ntpd to crash.

  - CVE-2015-7701     A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd is configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.

  - CVE-2015-7703     Miroslav Lichvar of Red Hat found that the :config     command can be used to set the pidfile and driftfile     paths without any restrictions. A remote attacker could     use this flaw to overwrite a file on the file system     with a file containing the pid of the ntpd process     (immediately) or the current estimated drift of the     system clock (in hourly intervals). For example :

  ntpq -c ':config pidfile /tmp/ntp.pid'ntpq -c ':config driftfile   /tmp/ntp.drift'

  In Debian ntpd is configured to drop root privileges, which limits   the impact of this issue.

  - CVE-2015-7704     If ntpd as an NTP client receives a Kiss-of-Death (KoD)     packet from the server to reduce its polling rate, it     doesn't check if the originate timestamp in the reply     matches the transmit timestamp from its request. An     off-path attacker can send a crafted KoD packet to the     client, which will increase the client's polling     interval to a large value and effectively disable     synchronization with the server.

  - CVE-2015-7850     An exploitable denial of service vulnerability exists in     the remote configuration functionality of the Network     Time Protocol. A specially crafted configuration file     could cause an endless loop resulting in a denial of     service. An attacker could provide a malicious     configuration file to trigger this vulnerability.

  - CVE-2015-7852     A potential off by one vulnerability exists in the     cookedprint functionality of ntpq. A specially crafted     buffer could cause a buffer overflow potentially     resulting in null byte being written out of bounds.

  - CVE-2015-7855     It was found that NTP's decodenetnum() would abort with     an assertion failure when processing a mode 6 or mode 7     packet containing an unusually long data value where a     network address was expected. This could allow an     authenticated attacker to crash ntpd.

  - CVE-2015-7871     An error handling logic error exists within ntpd that     manifests due to improper error condition handling     associated with certain crypto-NAK packets. An     unauthenticated, off-path attacker can force ntpd     processes on targeted servers to peer with time sources     of the attacker's choosing by transmitting symmetric     active crypto-NAK packets to ntpd. This attack bypasses     the authentication typically required to establish a     peer association and allows an attacker to make     arbitrary changes to system time.

This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues :

Also yast2-ntp-client was updated to match some sntp syntax changes.
(bsc#937837)

Major functional changes :

  - The 'sntp' commandline tool changed its option handling     in a major way.

  - 'controlkey 1' is added during update to ntp.conf to     allow sntp to work.

  - The local clock is being disabled during update.

  - ntpd is no longer running chrooted.

Other functional changes :

  - ntp-signd is installed.

  - 'enable mode7' can be added to the configuration to     allow ntdpc to work as compatibility mode option.

  - 'kod' was removed from the default restrictions.

  - SHA1 keys are used by default instead of MD5 keys.

These security issues were fixed :

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).

  - CVE-2015-8158: Fixed potential infinite loop in ntpq     (bsc#962966).

  - CVE-2015-8138: Zero Origin Timestamp Bypass     (bsc#963002).

  - CVE-2015-7979: Off-path Denial of Service (DoS) attack     on authenticated broadcast mode (bsc#962784).

  - CVE-2015-7978: Stack exhaustion in recursive traversal     of restriction list (bsc#963000).

  - CVE-2015-7977: reslist NULL pointer dereference     (bsc#962970).

  - CVE-2015-7976: ntpq saveconfig command allows dangerous     characters in filenames (bsc#962802).

  - CVE-2015-7975: nextvar() missing length check     (bsc#962988).

  - CVE-2015-7974: Skeleton Key: Missing key check allows     impersonation between authenticated peers (bsc#962960).

  - CVE-2015-7973: Replay attack on authenticated broadcast     mode (bsc#962995).

  - CVE-2015-8140: ntpq vulnerable to replay attacks     (bsc#962994).

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin (bsc#962997).

  - CVE-2015-5300: MITM attacker could have forced ntpd to     make a step larger than the panic threshold     (bsc#951629).

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK (bsc#951608).

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values (bsc#951608).

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow     (bsc#951608).

  - CVE-2015-7852: ntpq atoascii() Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7851: saveconfig Directory Traversal     Vulnerability (bsc#951608).

  - CVE-2015-7850: remote config logfile-keyfile     (bsc#951608).

  - CVE-2015-7849: trusted key use-after-free (bsc#951608).

  - CVE-2015-7848: mode 7 loop counter underrun     (bsc#951608).

  - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC     (bsc#951608).

  - CVE-2015-7703: configuration directives 'pidfile' and     'driftfile' should only be allowed locally (bsc#951608).

  - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD     should validate the origin timestamp field (bsc#951608).

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete     autokey data packet length checks (bsc#951608).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't allow spoofed packets to demobilize associations     (CVE-2015-7979, CVE-2016-1547)

  - don't allow spoofed packet to enable symmetric     interleaved mode (CVE-2016-1548)

  - check mode of new source in config command     (CVE-2016-2518)

  - make MAC check resilient against timing attack     (CVE-2016-1550)

  - don't accept server/peer packets with zero origin     timestamp (CVE-2015-8138)

  - fix crash with reslist command (CVE-2015-7977,     CVE-2015-7978)

  - fix crash with invalid logconfig command (CVE-2015-5194)

  - fix crash when referencing disabled statistic type     (CVE-2015-5195)

  - don't hang in sntp with crafted reply (CVE-2015-5219)

  - don't crash with crafted autokey packet (CVE-2015-7691,     CVE-2015-7692, CVE-2015-7702)

  - fix memory leak with autokey (CVE-2015-7701)

  - don't allow setting driftfile and pidfile remotely     (CVE-2015-7703)

  - don't crash in ntpq with crafted packet (CVE-2015-7852)

  - add option to set Differentiated Services Code Point     (DSCP) (#1228314)

  - extend rawstats log (#1242895)

  - fix resetting of leap status (#1243034)

  - report clock state changes related to leap seconds     (#1242937)

  - allow -4/-6 on restrict lines with mask (#1232146)

  - retry joining multicast groups (#1288534)

  - explain synchronised state in ntpstat man page     (#1286969)

  - check origin timestamp before accepting KoD RATE packet     (CVE-2015-7704)

  - allow only one step larger than panic threshold with -g     (CVE-2015-5300)

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed :

  - CVE-2016-9311, CVE-2016-9310, bsc#1011377: Mode 6     unauthenticated trap information disclosure and DDoS     vector.

  - CVE-2016-7427, bsc#1011390: Broadcast Mode Replay     Prevention DoS.

  - CVE-2016-7428, bsc#1011417: Broadcast Mode Poll Interval     Enforcement DoS.

  - CVE-2016-7431, bsc#1011395: Regression: 010-origin: Zero     Origin Timestamp Bypass.

  - CVE-2016-7434, bsc#1011398: NULL pointer dereference in
    _IO_str_init_static_internal().

  - CVE-2016-7429, bsc#1011404: Interface selection attack.

  - CVE-2016-7426, bsc#1011406: Client rate limiting and     server responses.

  - CVE-2016-7433, bsc#1011411: Reboot sync calculation     problem.

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).
    Non-security issues fixed :

  - Fix a spurious error message.

  - Other bugfixes, see     /usr/share/doc/packages/ntp/ChangeLog.

  - Fix a regression in 'trap' (bsc#981252).

  - Reduce the number of netlink groups to listen on for     changes to the local network setup (bsc#992606).

  - Fix segfault in 'sntp -a' (bsc#1009434).

  - Silence an OpenSSL version warning (bsc#992038).

  - Make the resolver task change user and group IDs to the     same values as the main task. (bsc#988028)

  - Simplify ntpd's search for its own executable to prevent     AppArmor warnings (bsc#956365).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
86331	Fedora 22 : ntp (2015-14212)	Nessus	Fedora Local Security Checks	2015/10/12	2025/8/29	high
89288	Fedora 21 : ntp (2015-77bfbc1bcd)	Nessus	Fedora Local Security Checks	2016/3/4	2025/8/29	critical
218849	Linux Distros Unpatched Vulnerability : CVE-2015-5219	Nessus	Misc.	2025/3/4	2026/1/28	high
86682	Debian DSA-3388-1 : ntp - security update	Nessus	Debian Local Security Checks	2015/11/2	2021/1/11	critical
91248	SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1311-1)	Nessus	SuSE Local Security Checks	2016/5/19	2021/1/19	critical
91419	OracleVM 3.3 / 3.4 : ntp (OVMSA-2016-0082)	Nessus	OracleVM Local Security Checks	2016/6/1	2021/1/4	high
95987	SUSE SLED12 / SLES12 Security Update : ntp (SUSE-SU-2016:3195-1)	Nessus	SuSE Local Security Checks	2016/12/21	2026/1/7	medium
95988	SUSE SLES12 Security Update : ntp (SUSE-SU-2016:3196-1)	Nessus	SuSE Local Security Checks	2016/12/21	2026/1/7	medium

检测

插件搜索

high

critical

high

critical

critical

high

medium

medium