An update for ntp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially crafted NTP packet to crash ntpd.
(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

* A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory. (CVE-2015-7701)

* An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

* A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could potentially use this flaw to crash ntpd. (CVE-2015-7977)

* A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash ntpd. (CVE-2015-7978)

* It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

* It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) was referenced by the statistics or filegen configuration command. (CVE-2015-5195)

* It was discovered that the sntp utility could become unresponsive due to being caught in an infinite loop when processing a crafted NTP packet. (CVE-2015-5219)

* It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-7703)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvar (Red Hat).

For detailed information on changes in this release, see the Red Hat Enterprise Linux 6.8 Release Notes and Red Hat Enterprise Linux 6.8 Technical Notes linked from the References section.

Security Fix(es) :

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A remote     attacker could use a specially crafted NTP packet to     crash ntpd. (CVE-2015-7691, CVE-2015-7692,     CVE-2015-7702)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory. (CVE-2015-7701)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash. (CVE-2015-7852)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to crash     ntpd. (CVE-2015-7977)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash ntpd.
    (CVE-2015-7978)

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands. (CVE-2015-5194)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled during     compilation (e.g. timingstats) was referenced by the     statistics or filegen configuration command.
    (CVE-2015-5195)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet. (CVE-2015-5219)

  - It was found that NTP's :config command could be used to     set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals). (CVE-2015-7703)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvr (Red Hat).

An update for ntp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* It was found that the fix for CVE-2014-9750 was incomplete: three issues were found in the value length checks in NTP's ntp_crypto.c, where a packet with particular autokey operations that contained malicious data was not always being completely validated. A remote attacker could use a specially crafted NTP packet to crash ntpd.
(CVE-2015-7691, CVE-2015-7692, CVE-2015-7702)

* A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd was configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory. (CVE-2015-7701)

* An off-by-one flaw, leading to a buffer overflow, was found in cookedprint functionality of ntpq. A specially crafted NTP packet could potentially cause ntpq to crash. (CVE-2015-7852)

* A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could potentially use this flaw to crash ntpd. (CVE-2015-7977)

* A stack-based buffer overflow flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash ntpd. (CVE-2015-7978)

* It was found that when NTP was configured in broadcast mode, a remote attacker could broadcast packets with bad authentication to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server, causing them to become out of sync over a longer period of time. (CVE-2015-7979)

* It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands.
(CVE-2015-5194)

* It was found that ntpd would exit with a segmentation fault when a statistics type that was not enabled during compilation (e.g.
timingstats) was referenced by the statistics or filegen configuration command. (CVE-2015-5195)

* It was found that NTP's :config command could be used to set the pidfile and driftfile paths without any restrictions. A remote attacker could use this flaw to overwrite a file on the file system with a file containing the pid of the ntpd process (immediately) or the current estimated drift of the system clock (in hourly intervals).
(CVE-2015-5196, CVE-2015-7703)

* It was discovered that the sntp utility could become unresponsive due to being caught in an infinite loop when processing a crafted NTP packet. (CVE-2015-5219)

* A flaw was found in the way NTP verified trusted keys during symmetric key authentication. An authenticated client (A) could use this flaw to modify a packet sent between a server (B) and a client (C) using a key that is different from the one known to the client (A). (CVE-2015-7974)

* A flaw was found in the way the ntpq client processed certain incoming packets in a loop in the getresponse() function. A remote attacker could potentially use this flaw to crash an ntpq client instance. (CVE-2015-8158)

The CVE-2015-5219 and CVE-2015-7703 issues were discovered by Miroslav Lichvar (Red Hat).

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

ntp was updated to version 4.2.8p6 to fix 12 security issues.

These security issues were fixed :

  - CVE-2015-8158: Fixed potential infinite loop in ntpq     (bsc#962966).

  - CVE-2015-8138: Zero Origin Timestamp Bypass     (bsc#963002).

  - CVE-2015-7979: Off-path Denial of Service (DoS) attack     on authenticated broadcast mode (bsc#962784).

  - CVE-2015-7978: Stack exhaustion in recursive traversal     of restriction list (bsc#963000).

  - CVE-2015-7977: reslist NULL pointer dereference     (bsc#962970).

  - CVE-2015-7976: ntpq saveconfig command allows dangerous     characters in filenames (bsc#962802).

  - CVE-2015-7975: nextvar() missing length check     (bsc#962988).

  - CVE-2015-7974: Skeleton Key: Missing key check allows     impersonation between authenticated peers (bsc#962960).

  - CVE-2015-7973: Replay attack on authenticated broadcast     mode (bsc#962995).

  - CVE-2015-8140: ntpq vulnerable to replay attacks     (bsc#962994).

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin (bsc#962997).

  - CVE-2015-5300: MITM attacker could have forced ntpd to     make a step larger than the panic threshold     (bsc#951629).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ntp was updated to version 4.2.8p6 to fix 12 security issues.

Also yast2-ntp-client was updated to match some sntp syntax changes.
(bsc#937837)

These security issues were fixed :

  - CVE-2015-8158: Fixed potential infinite loop in ntpq     (bsc#962966).

  - CVE-2015-8138: Zero Origin Timestamp Bypass     (bsc#963002).

  - CVE-2015-7979: Off-path Denial of Service (DoS) attack     on authenticated broadcast mode (bsc#962784).

  - CVE-2015-7978: Stack exhaustion in recursive traversal     of restriction list (bsc#963000).

  - CVE-2015-7977: reslist NULL pointer dereference     (bsc#962970).

  - CVE-2015-7976: ntpq saveconfig command allows dangerous     characters in filenames (bsc#962802).

  - CVE-2015-7975: nextvar() missing length check     (bsc#962988).

  - CVE-2015-7974: Skeleton Key: Missing key check allows     impersonation between authenticated peers (bsc#962960).

  - CVE-2015-7973: Replay attack on authenticated broadcast     mode (bsc#962995).

  - CVE-2015-8140: ntpq vulnerable to replay attacks     (bsc#962994).

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin (bsc#962997).

  - CVE-2015-5300: MITM attacker could have forced ntpd to     make a step larger than the panic threshold     (bsc#951629).

These non-security issues were fixed :

  - fate#320758 bsc#975981: Enable compile-time support for     MS-SNTP (--enable-ntp-signd). This replaces the w32     patches in 4.2.4 that added the authreg directive.

  - bsc#962318: Call /usr/sbin/sntp with full path to     synchronize in start-ntpd. When run as cron job,     /usr/sbin/ is not in the path, which caused the     synchronization to fail.

  - bsc#782060: Speedup ntpq.

  - bsc#916617: Add /var/db/ntp-kod.

  - bsc#956773: Add ntp-ENOBUFS.patch to limit a warning     that might happen quite a lot on loaded systems.

  - bsc#951559,bsc#975496: Fix the TZ offset output of sntp     during DST.

  - Add ntp-fork.patch and build with threads disabled to     allow name resolution even when running chrooted.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

The remote host is affected by the vulnerability described in GLSA-201607-15 (NTP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in NTP. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs :

CVE-2015-7974

Matt Street discovered that insufficient key validation allows impersonation attacks between authenticated peers.

CVE-2015-7977 / CVE-2015-7978

Stephen Gray discovered that a NULL pointer dereference and a buffer overflow in the handling of 'ntpdc reslist' commands may result in denial of service.

CVE-2015-7979

Aanchal Malhotra discovered that if NTP is configured for broadcast mode, an attacker can send malformed authentication packets which break associations with the server for other broadcast clients.

CVE-2015-8138

Matthew van Gundy and Jonathan Gardner discovered that missing validation of origin timestamps in ntpd clients may result in denial of service.

CVE-2015-8158

Jonathan Gardner discovered that missing input sanitising in ntpq may result in denial of service.

CVE-2016-1547

Stephen Gray and Matthew van Gundy discovered that incorrect handling of crypto NAK packets my result in denial of service.

CVE-2016-1548

Jonathan Gardner and Miroslav Lichvar discovered that ntpd clients could be forced to change from basic client/server mode to interleaved symmetric mode, preventing time synchronisation.

CVE-2016-1550

Matthew van Gundy, Stephen Gray and Loganaden Velvindron discovered that timing leaks in the the packet authentication code could result in recovery of a message digest.

CVE-2016-2516

Yihan Lian discovered that duplicate IPs on 'unconfig' directives will trigger an assert.

CVE-2016-2518

Yihan Lian discovered that an OOB memory access could potentially crash ntpd.

For Debian 7 'Wheezy', these problems have been fixed in version 1:4.2.6.p5+dfsg-2+deb7u7.

We recommend that you upgrade your ntp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that ntpd as a client did not correctly check the originate timestamp in received packets. A remote attacker could use this flaw to send a crafted packet to an ntpd client that would effectively disable synchronization with the server, or push arbitrary offset/delay measurements to modify the time on the client.
(CVE-2015-8138)

A NULL pointer dereference flaw was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash the ntpd process. (CVE-2015-7977)

It was found that NTP does not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key.
(CVE-2015-7974)

A stack-based buffer overflow was found in the way ntpd processed 'ntpdc reslist' commands that queried restriction lists with a large amount of entries. A remote attacker could use this flaw to crash the ntpd process. (CVE-2015-7978)

It was found that when NTP is configured in broadcast mode, an off-path attacker could broadcast packets with bad authentication (wrong key, mismatched key, incorrect MAC, etc) to all clients. The clients, upon receiving the malformed packets, would break the association with the broadcast server. This could cause the time on affected clients to become out of sync over a longer period of time.
(CVE-2015-7979)

A flaw was found in the way the ntpq client certain processed incoming packets in a loop in the getresponse() function. A remote attacker could potentially use this flaw to crash an ntpq client instance.
(CVE-2015-8158)

A flaw was found in ntpd that allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time. (CVE-2016-4953)

(Updated 2016-10-18: CVE-2016-4953 was fixed in this release but was not previously part of this errata.)

This network time protocol server ntp was updated to 4.2.8p6 to fix the following issues :

Also yast2-ntp-client was updated to match some sntp syntax changes.
(bsc#937837)

Major functional changes :

  - The 'sntp' commandline tool changed its option handling     in a major way.

  - 'controlkey 1' is added during update to ntp.conf to     allow sntp to work.

  - The local clock is being disabled during update.

  - ntpd is no longer running chrooted.

Other functional changes :

  - ntp-signd is installed.

  - 'enable mode7' can be added to the configuration to     allow ntdpc to work as compatibility mode option.

  - 'kod' was removed from the default restrictions.

  - SHA1 keys are used by default instead of MD5 keys.

These security issues were fixed :

  - CVE-2015-5219: An endless loop due to incorrect     precision to double conversion (bsc#943216).

  - CVE-2015-8158: Fixed potential infinite loop in ntpq     (bsc#962966).

  - CVE-2015-8138: Zero Origin Timestamp Bypass     (bsc#963002).

  - CVE-2015-7979: Off-path Denial of Service (DoS) attack     on authenticated broadcast mode (bsc#962784).

  - CVE-2015-7978: Stack exhaustion in recursive traversal     of restriction list (bsc#963000).

  - CVE-2015-7977: reslist NULL pointer dereference     (bsc#962970).

  - CVE-2015-7976: ntpq saveconfig command allows dangerous     characters in filenames (bsc#962802).

  - CVE-2015-7975: nextvar() missing length check     (bsc#962988).

  - CVE-2015-7974: Skeleton Key: Missing key check allows     impersonation between authenticated peers (bsc#962960).

  - CVE-2015-7973: Replay attack on authenticated broadcast     mode (bsc#962995).

  - CVE-2015-8140: ntpq vulnerable to replay attacks     (bsc#962994).

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin (bsc#962997).

  - CVE-2015-5300: MITM attacker could have forced ntpd to     make a step larger than the panic threshold     (bsc#951629).

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK (bsc#951608).

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values (bsc#951608).

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow     (bsc#951608).

  - CVE-2015-7852: ntpq atoascii() Memory Corruption     Vulnerability (bsc#951608).

  - CVE-2015-7851: saveconfig Directory Traversal     Vulnerability (bsc#951608).

  - CVE-2015-7850: remote config logfile-keyfile     (bsc#951608).

  - CVE-2015-7849: trusted key use-after-free (bsc#951608).

  - CVE-2015-7848: mode 7 loop counter underrun     (bsc#951608).

  - CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC     (bsc#951608).

  - CVE-2015-7703: configuration directives 'pidfile' and     'driftfile' should only be allowed locally (bsc#951608).

  - CVE-2015-7704, CVE-2015-7705: Clients that receive a KoD     should validate the origin timestamp field (bsc#951608).

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702: Incomplete     autokey data packet length checks (bsc#951608).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - don't allow spoofed packets to demobilize associations     (CVE-2015-7979, CVE-2016-1547)

  - don't allow spoofed packet to enable symmetric     interleaved mode (CVE-2016-1548)

  - check mode of new source in config command     (CVE-2016-2518)

  - make MAC check resilient against timing attack     (CVE-2016-1550)

  - don't accept server/peer packets with zero origin     timestamp (CVE-2015-8138)

  - fix crash with reslist command (CVE-2015-7977,     CVE-2015-7978)

  - fix crash with invalid logconfig command (CVE-2015-5194)

  - fix crash when referencing disabled statistic type     (CVE-2015-5195)

  - don't hang in sntp with crafted reply (CVE-2015-5219)

  - don't crash with crafted autokey packet (CVE-2015-7691,     CVE-2015-7692, CVE-2015-7702)

  - fix memory leak with autokey (CVE-2015-7701)

  - don't allow setting driftfile and pidfile remotely     (CVE-2015-7703)

  - don't crash in ntpq with crafted packet (CVE-2015-7852)

  - add option to set Differentiated Services Code Point     (DSCP) (#1228314)

  - extend rawstats log (#1242895)

  - fix resetting of leap status (#1243034)

  - report clock state changes related to leap seconds     (#1242937)

  - allow -4/-6 on restrict lines with mask (#1232146)

  - retry joining multicast groups (#1288534)

  - explain synchronised state in ntpstat man page     (#1286969)

  - check origin timestamp before accepting KoD RATE packet     (CVE-2015-7704)

  - allow only one step larger than panic threshold with -g     (CVE-2015-5300)

This update for ntp fixes the following issues :

  - Update to 4.2.8p7 (boo#977446) :

  - CVE-2016-1547, boo#977459: Validate crypto-NAKs, AKA:
    CRYPTO-NAK DoS.

  - CVE-2016-1548, boo#977461: Interleave-pivot

  - CVE-2016-1549, boo#977451: Sybil vulnerability:
    ephemeral association attack.

  - CVE-2016-1550, boo#977464: Improve NTP security against     buffer comparison timing attacks.

  - CVE-2016-1551, boo#977450: Refclock impersonation     vulnerability

  - CVE-2016-2516, boo#977452: Duplicate IPs on unconfig     directives will cause an assertion botch in ntpd.

  - CVE-2016-2517, boo#977455: remote configuration     trustedkey/ requestkey/controlkey values are not     properly validated.

  - CVE-2016-2518, boo#977457: Crafted addpeer with hmode >     7 causes array wraparound with MATCH_ASSOC.

  - CVE-2016-2519, boo#977458: ctl_getitem() return value     not always checked.

  - integrate ntp-fork.patch

  - Improve the fixes for: CVE-2015-7704, CVE-2015-7705,     CVE-2015-7974

  - Restrict the parser in the startup script to the first     occurrance of 'keys' and 'controlkey' in ntp.conf     (boo#957226).

  - Enable compile-time support for MS-SNTP     (--enable-ntp-signd). This replaces the w32 patches in     4.2.4 that added the authreg directive. (fate#320758).

  - Fix ntp-sntp-dst.patch (boo#975496).

  - Call /usr/sbin/sntp with full path to synchronize in     start-ntpd. When run as cron job, /usr/sbin/ is not in     the path, which caused the synchronization to fail.
    (boo#962318)

  - Speedup ntpq (boo#782060, ntp-speedup-ntpq.patch).

  - Sync service files with openSUSE Factory.

  - Fix the TZ offset output of sntp during DST     (boo#951559).

  - Add ntp-fork.patch and build with threads disabled to     allow name resolution even when running chrooted.

  - Update to 4.2.8p6 :

  - CVE-2015-8158, boo#962966: Potential Infinite Loop in     ntpq.

  - CVE-2015-8138, boo#963002: origin: Zero Origin Timestamp     Bypass.

  - CVE-2015-7979, boo#962784: Off-path Denial of Service     (DoS) attack on authenticated broadcast mode.

  - CVE-2015-7978, boo#963000: Stack exhaustion in recursive     traversal of restriction list.

  - CVE-2015-7977, boo#962970: reslist NULL pointer     dereference.

  - CVE-2015-7976, boo#962802: ntpq saveconfig command     allows dangerous characters in filenames.

  - CVE-2015-7975, boo#962988: nextvar() missing length     check.

  - CVE-2015-7974, boo#962960: Skeleton Key: Missing key     check allows impersonation between authenticated peers.

  - CVE-2015-7973, boo#962995: Deja Vu: Replay attack on     authenticated broadcast mode.

  - CVE-2015-8140: ntpq vulnerable to replay attacks.

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin.

  - CVE-2015-5300, boo#951629: Small-step/Big-step.

  - Add /var/db/ntp-kod (boo#916617).

  - Add ntp-ENOBUFS.patch to limit a warning that might     happen quite a lot on loaded systems (boo#956773).

  - add ntp.bug2965.diff (boo#954982)

  - fixes regression in 4.2.8p4 update

  - Update to 4.2.8p4 to fix several security issues     (boo#951608) :

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow

  - CVE-2015-7852 ntpq atoascii() Memory Corruption     Vulnerability

  - CVE-2015-7851 saveconfig Directory Traversal     Vulnerability

  - CVE-2015-7850 remote config logfile-keyfile

  - CVE-2015-7849 trusted key use-after-free

  - CVE-2015-7848 mode 7 loop counter underrun

  - CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC

  - CVE-2015-7703 configuration directives 'pidfile' and     'driftfile' should only be allowed locally

  - CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD     should validate the origin timestamp field

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete     autokey data packet length checks

  - obsoletes ntp-memlock.patch.

  - Add a controlkey line to /etc/ntp.conf if one does not     already exist to allow runtime configuuration via ntpq.

  - Temporarily disable memlock to avoid problems due to     high memory usage during name resolution (boo#946386,     ntp-memlock.patch).

  - Use SHA1 instead of MD5 for symmetric keys (boo#905885).

  - Improve runtime configuration :

  - Read keytype from ntp.conf

  - Don't write ntp keys to syslog.

  - Fix legacy action scripts to pass on command line     arguments.

  - Remove ntp.1.gz, it wasn't installed anymore.

  - Remove ntp-4.2.7-rh-manpages.tar.gz and only keep     ntptime.8.gz. The rest is partially irrelevant,     partially redundant and potentially outdated     (boo#942587).

  - Remove 'kod' from the restrict line in ntp.conf     (boo#944300).

  - Use ntpq instead of deprecated ntpdc in start-ntpd     (boo#936327).

  - Add a controlkey to ntp.conf to make the above work.

  - Don't let 'keysdir' lines in ntp.conf trigger the 'keys'     parser.

  - Disable mode 7 (ntpdc) again, now that we don't use it     anymore.

  - Add 'addserver' as a new legacy action.

  - Fix the comment regarding addserver in ntp.conf     (boo#910063).

  - Update to version 4.2.8p3 which incorporates all     security fixes and most other patches we have so far     (fate#319040). More information on:
    http://archive.ntp.org/ntp4/ChangeLog-stable

  - Disable chroot by default (boo#926510).

  - Enable ntpdc for backwards compatibility (boo#920238).

  - Security fix: ntp-keygen may generate non-random     symmetric keys

遠端 NTP 伺服器的版本是 3.x 版或 4.2.8p6 之前的 4.x 版。
因此，該應用程式受到以下弱點影響：

  - receive() 函式中存在一個瑕疵，這是因為使用經驗證的廣播模式所致。攔截式攻擊者可惡意利用此問題，發動重播攻擊。
    (CVE-2015-7973)

  - 受信任的金鑰系統中存在一個時間服務瑕疵，這是因為不當的金鑰檢查所導致。經驗證的遠端攻擊者可惡意利用此瑕疵，在經驗證的對等端之間發動模擬攻擊。(CVE-2015-7974)

  - nextvar() 函式存在一個因不當驗證使用者提供的輸入所導致的溢位情形。本機攻擊者可惡意利用此問題，造成緩衝區溢位，進而導致拒絕服務情形。
    (CVE-2015-7975)

  - ntp_control.c 中存在一個瑕疵，這是因為 saveconfig 命令不當篩選檔名中的特殊字元所導致。經驗證的遠端攻擊者可惡意利用此瑕疵插入任意內容。(CVE-2015-7976)

  - ntp_request.c 中存在一個 NULL 指標解除參照瑕疵，當處理 ntpdc relist 命令時會觸發。
    遠端攻擊者可惡意利用此瑕疵，透過特製的要求造成服務損毀，進而導致拒絕服務情形。(CVE-2015-7977)

  - ntpdc 中存在一個瑕疵，處理 relist 命令期間會觸發此瑕疵。遠端攻擊者可惡意利用此瑕疵，透過遞迴遊走限制清單，耗盡呼叫堆疊上的可用空間，進而導致拒絕服務情形。
    CVE-2015-7978)

  - 經驗證的廣播模式中存在一個不明瑕疵。遠端攻擊者可惡意利用此瑕疵，透過特製的封包造成拒絕服務情形。
    (CVE-2015-7979)

  - receive() 函式中存在一個瑕疵，其允許含有零來源時間戳記的封包繞過安全性檢查。遠端攻擊者可惡意利用此瑕疵偽造任意內容。(CVE-2015-8138)

  - ntpq 與 ntpdc 中存在一個瑕疵，允許遠端攻擊者洩漏時間戳記中的敏感資訊。(CVE-2015-8139)

  - ntpq 通訊協定中存在一個可在處理不當數列期間觸發的瑕疵。
    攔截式攻擊者可惡意利用此問題，發動重播攻擊。(CVE-2015-8140)

  - ntpq 用戶端中存在一個瑕疵，處理封包時會觸發此瑕疵，在 getresponse() 函式中造成迴圈。遠端攻擊者可惡意利用此瑕疵造成無限迴圈，進而導致拒絕服務情形。(CVE-2015-8158)

現已提供適用於 Red Hat Enterprise Linux 6 的 ntp 更新。

Red Hat 產品安全性團隊已將此更新評等為具有「中等」安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

網路時間通訊協定 (NTP) 可用來同步電腦的時間與另一個參照的時間來源。這些套件包括 ntpd 服務，其會持續調整系統時間，以及用來查詢和設定 ntpd 服務的公用程式。

安全性修正：

* 據發現，CVE-2014-9750 的修正並不完整：在 NTP 之 ntp_crypto.c 的值長度檢查中發現三個問題，具有特定自動金鑰作業且包含惡意資料的封包並非每一次都經過完整驗證。遠端攻擊者可使用特製 NTP 封包造成 ntpd 損毀。
(CVE-2015-7691、CVE-2015-7692、CVE-2015-7702)

* 在 ntpd 的 CRYPTO_ASSOC 中發現一個記憶體洩漏瑕疵。如果 ntpd 設為使用自動金鑰驗證，攻擊者即可傳送封包至 ntpd，並且連續數天發動攻擊，從而造成其記憶體不足。(CVE-2015-7701)

* 在 ntpq 的 cookedprint 功能中發現一個差一缺陷，其可導致緩衝區溢位。特別建構的 NTP 封包可能造成 ntpq 損毀。(CVE-2015-7852)

* 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個 NULL 指標解除參照缺陷。遠端攻擊者可能利用此缺陷造成 ntpd 損毀。(CVE-2015-7977)

* 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個堆疊型緩衝區溢位缺陷。遠端攻擊者可利用此缺陷造成 ntpd 損毀。(CVE-2015-7978)

* 據發現，ntpd 在處理異常 logconfig 組態命令時可能會因未初始化的變數而損毀。
(CVE-2015-5194)

* 據發現，當在編譯期間未啟用的統計資料類型 (
如 timingstats) 受到統計資料或 filegen 組態命令參照時，ntpd 會因分割錯誤而結束。(CVE-2015-5195)

* 據發現，處理特別建構的 NTP 封包時，sntp 公用程式會因在無限迴圈中被擷取而停止回應。(CVE-2015-5219)

* 據發現，NTP 的:config 命令可用於設定 pidfile 和 driftfile 路徑，而無任何限制。遠端攻擊者可利用此缺陷，將檔案系統上的檔案覆寫為含有 ntpd 處理程序 pid 的檔案 (立即)，或是系統時鐘目前的預估偏離 (以小時為間隔)。
(CVE-2015-7703)

CVE-2015-5219 和 CVE-2015-7703 問題由 Red Hat 的 Miroslav Lichvar (Red Hat) 發現。

如需有關此發行版本的詳細變更資訊，請參閱可從〈參照〉一節連結的 Red Hat Enterprise Linux 6.8 版本說明與 Red Hat Enterprise Linux 6.8 技術提示。

安全性修正：

- 據發現，CVE-2014-9750 的修正並不完整：在 NTP 之 ntp_crypto.c 的值長度檢查中發現三個問題，具有特定自動金鑰作業且包含惡意資料的封包並非每一次都經過完整驗證。遠端攻擊者可使用特製 NTP 封包造成 ntpd 損毀。(CVE-2015-7691、CVE-2015-7692、CVE-2015-7702)

- 在 ntpd 的 CRYPTO_ASSOC 中發現一個記憶體洩漏瑕疵。如果 ntpd 設為使用自動金鑰驗證，攻擊者即可傳送封包至 ntpd，並且連續數天發動攻擊，從而造成其記憶體不足。(CVE-2015-7701)

- 在 ntpq 的 cookedprint 功能中發現一個差一瑕疵，其可導致緩衝區溢位。特製 NTP 封包可能造成 ntpq 損毀。(CVE-2015-7852)

- 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個 NULL 指標解除參照瑕疵。遠端攻擊者可能利用此瑕疵造成 ntpd 損毀。(CVE-2015-7977)

- 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個堆疊型緩衝區溢位瑕疵。遠端攻擊者可利用此瑕疵造成 ntpd 損毀。
 (CVE-2015-7978)

- 據發現，ntpd 在處理格式錯誤之 logconfig 組態命令時可能因未初始化的變數而損毀。(CVE-2015-5194)

- 據發現，當未啟用的統計資料類型在編譯時 (如 timingstats) 受到統計資料或 filegen 組態命令參照時，ntpd 會因分割錯誤而結束。
 (CVE-2015-5195)

- 據發現，sntp 公用程式會因處理特製 NTP 封包時，在無限迴圈中擷取而變得沒有回應。(CVE-2015-5219)

- 據發現，NTP 的 :config 命令可用於設定 pidfile 和 driftfile 路徑，而無任何限制。遠端攻擊者可利用此瑕疵，將檔案系統上的檔案覆寫為含有 ntpd 處理程序 pid 的檔案 (立即)，或是系統時鐘目前的預估偏離 (以小時為間隔)。(CVE-2015-7703)

CVE-2015-5219 和 CVE-2015-7703 問題由 Miroslav Lichvr (Red Hat) 發現。

現已提供適用於 Red Hat Enterprise Linux 7 的 ntp 更新。

Red Hat 產品安全性團隊已將此更新評等為具有「中等」安全性影響。可從〈參照〉一節的 CVE 連結中取得每個弱點之常見弱點評分系統 (CVSS) 的基本分數，其中包含有關嚴重性評等的詳細資訊。

網路時間通訊協定 (NTP) 可用來同步電腦的時間與另一個參照的時間來源。這些套件包括 ntpd 服務，其會持續調整系統時間，以及用來查詢和設定 ntpd 服務的公用程式。

安全性修正：

* 據發現，CVE-2014-9750 的修正並不完整：在 NTP 之 ntp_crypto.c 的值長度檢查中發現三個問題，具有特定自動金鑰作業且包含惡意資料的封包並非每一次都經過完整驗證。遠端攻擊者可使用特製 NTP 封包造成 ntpd 損毀。
(CVE-2015-7691、CVE-2015-7692、CVE-2015-7702)

* 在 ntpd 的 CRYPTO_ASSOC 中發現一個記憶體洩漏瑕疵。如果 ntpd 設為使用自動金鑰驗證，攻擊者即可傳送封包至 ntpd，並且連續數天發動攻擊，從而造成其記憶體不足。(CVE-2015-7701)

* 在 ntpq 的 cookedprint 功能中發現一個差一缺陷，其可導致緩衝區溢位。特別建構的 NTP 封包可能造成 ntpq 損毀。(CVE-2015-7852)

* 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個 NULL 指標解除參照缺陷。遠端攻擊者可能利用此缺陷造成 ntpd 損毀。(CVE-2015-7977)

* 在 ntpd 處理「ntpdc reslist」命令 (可查詢具有大量項目的限制清單) 的方式中發現一個堆疊型緩衝區溢位缺陷。遠端攻擊者可利用此缺陷造成 ntpd 損毀。(CVE-2015-7978)

* 據發現，將 NTP 設定為廣播模式時，遠端攻擊者可使用錯誤的驗證向所有用戶端廣播封包。用戶端在收到格式錯誤的封包時，會中斷與廣播伺服器的關聯，造成自身長時間處於非同步狀態。(CVE-2015-7979)

* 據發現，ntpd 在處理異常 logconfig 組態命令時可能會因未初始化的變數而損毀。
(CVE-2015-5194)

* 據發現，當在編譯期間未啟用的統計資料類型 (
如 timingstats) 受到統計資料或 filegen 組態命令參照時，ntpd 會因分割錯誤而結束。(CVE-2015-5195)

* 據發現，NTP 的:config 命令可用於設定 pidfile 和 driftfile 路徑，而無任何限制。遠端攻擊者可利用此缺陷，將檔案系統上的檔案覆寫為含有 ntpd 處理程序 pid 的檔案 (立即)，或是系統時鐘目前的預估偏離 (以小時為間隔)。
(CVE-2015-5196、CVE-2015-7703)

* 據發現，處理特別建構的 NTP 封包時，sntp 公用程式會因在無限迴圈中被擷取而停止回應。(CVE-2015-5219)

* 在 NTP 於對稱金鑰驗證期間確認受信任金鑰的方式中，發現一個缺陷。經驗證的用戶端 (A) 可利用缺陷，藉由不同於用戶端 (A) 已知金鑰的金鑰，修改在伺服器 (B) 和用戶端 (C) 之間傳送的封包。(CVE-2015-7974)

* 在 ntpq 用戶端處理 getresponse() 函式之迴圈的傳入封包的方式中發現一個缺陷。遠端攻擊者可能利用此缺陷造成 ntpd 用戶端執行個體損毀。(CVE-2015-8158)

CVE-2015-5219 和 CVE-2015-7703 問題由 Red Hat 的 Miroslav Lichvar (Red Hat) 發現。

其他變更：

如需有關此發行版本的詳細變更資訊，請參閱可從〈參照〉一節連結的「Red Hat Enterprise Linux 7.3 版本資訊」。

Aanchal Malhotra 發現 NTP 未正確處理已驗證的廣播模式。遠端攻擊者可利用此問題發動重新執行攻擊。(CVE-2015-7973)

Matt Street 發現 NTP 未正確驗證對稱金鑰的對等關聯。遠端攻擊者可利用此問題發動模擬攻擊。(CVE-2015-7974)

Jonathan Gardner 發現 NTP ntpq 公用程式未正確處理記憶體。攻擊者可能會利用此問題造成 ntpq 損毀，進而導致拒絕服務。這個問題只會影響 Ubuntu 16.04 LTS。(CVE-2015-7975)

Jonathan Gardner 發現 NTP ntpq 公用程式未正確處理檔案名稱中危險的字元。攻擊者可能會利用此問題來覆寫任意檔案。(CVE-2015-7976)

Stephen Gray 發現 NTP 未正確處理大型限制清單。攻擊者可利用此問題造成 NTP 當機，進而導致拒絕服務。(CVE-2015-7977、CVE-2015-7978)

Aanchal Malhotra 發現 NTP 未正確處理已驗證的廣播模式。遠端攻擊者可利用此問題造成 NTP 損毀，進而導致拒絕服務。(CVE-2015-7979)

Jonathan Gardner 發現 NTP 未正確處理原始時間戳記檢查。遠端攻擊者可利用此問題偽造對等伺服器。(CVE-2015-8138)

Jonathan Gardner 發現 NTP ntpq 公用程式未正確處理某些錯誤值。攻擊者可能會利用此問題造成 ntpq 懸置，進而導致拒絕服務。
(CVE-2015-8158)

據發現，NTP cronjob 未正確清理統計資料目錄。本機攻擊者可能會利用此問題提升權限。(CVE-2016-0727)

Stephen Gray 和 Matthew Van Gundy 發現 NTP 未正確處理已驗證的 crypto-NAK。遠端攻擊者可能會利用此問題阻止用戶端進行同步處理。(CVE-2016-1547)

Miroslav Lichvar 和 Jonathan Gardner 發現 NTP 未正確處理切換到交錯對稱模式。遠端攻擊者可能會利用此問題阻止用戶端進行同步處理。
(CVE-2016-1548)

Matthew Van Gundy、Stephen Gray 和 Loganaden Velvindron 發現 NTP 未正確處理訊息驗證。遠端攻擊者可能會利用此問題復原訊息摘要金鑰。
(CVE-2016-1550)

Yihan Lian 發現 NTP 未正確處理未設定的指示詞中重複的 IP。經驗證的遠端攻擊者可能會利用此問題造成 NTP 損毀，進而導致拒絕服務。(CVE-2016-2516)

Yihan Lian 發現 NTP 未正確處理某些對等關聯。遠端攻擊者可能會利用此問題造成 NTP 損毀，進而導致拒絕服務。(CVE-2016-2518)

Jakub Prokes 發現 NTP 未正確處理某些偽造的封包。遠端攻擊者可能利用此問題造成拒絕服務。(CVE-2016-4954)

Miroslav Lichvar 發現當啟用自動金鑰時，NTP 未正確處理某些封包。遠端攻擊者可能利用此問題造成拒絕服務。(CVE-2016-4955)

Miroslav Lichvar 發現 NTP 未正確處理某些偽造的廣播封包。遠端攻擊者可能利用此問題造成拒絕服務。(CVE-2016-4956)

預設安裝中，攻擊者會遭到 NTP AppArmor 設定檔隔離。

請注意，Tenable Network Security 已直接從 Ubuntu 安全性公告擷取前述描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

ntp 已更新至 4.2.8p6 版，修正了 12 個安全性問題。

已修正這些安全性問題：

- CVE-2015-8158：已修正 ntpq 中的潛在無限迴圈 (bsc#962966)。

- CVE-2015-8138：零來源時間戳記繞過 (bsc#963002)。

- CVE-2015-7979：對經驗證廣播模式發動的路徑外拒絕服務 (DoS) 攻擊 (bsc#962784)。

- CVE-2015-7978：限制清單遞迴遊走中的堆疊耗盡 (bsc#963000)。

- CVE-2015-7977：reslist NULL 指標解除參照 (bsc#962970)。

- CVE-2015-7976：ntpq saveconfig 命令允許在檔案名稱中存在危險字元 (bsc#962802)。

- CVE-2015-7975：nextvar() 遺漏長度檢查 (bsc#962988)。

- CVE-2015-7974：萬能金鑰：遺漏金鑰檢查允許在經驗證的對等端之間模擬 (bsc#962960)。

- CVE-2015-7973：對經驗證的廣播模式發動重播攻擊 (bsc#962995)。

- CVE-2015-8140：ntpq 容易遭受重播攻擊 (bsc#962994)。

- CVE-2015-8139：來源洩漏：ntpq 與 ntpdc，洩漏來源 (bsc#962997)。

- CVE-2015-5300：MITM 攻擊者可強制 ntpd 跨出大於錯誤閾值的一步 (bsc#951629)。

已修正下列非安全性錯誤：

- fate#320758 bsc#975981：針對 MS-SNTP 啟用編譯時間支援 (--enable-ntp-signd)。這會取代 4.2.4 中的 w32 修補程式，其新增了 authreg 指示詞。

- bsc#962318：以完整路徑呼叫 /usr/sbin/sntp 以在 start-ntpd 中同步。當以 cron 工作身分執行時，/usr/sbin/ 不在路徑中，其可造成同步失敗。

- bsc#782060：加速 ntpq。

- bsc#916617：新增 /var/db/ntp-kod。

- bsc#956773：新增 ntp-ENOBUFS.patch 以限制可能在載入系統上時常發生的警告。

- bsc#951559、bsc#975496：修正 sntp 在 DST 期間的 TZ 位移輸出。

- 新增 ntp-fork.patch 並在停用執行緒的情況下構建以允許即使在執行 chrooted 時也進行名稱解析。

- bsc#784760：從預設組態中移除本機時鐘

請注意，Tenable Network Security 已直接從 SUSE 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

ntp 已更新至 4.2.8p6 版，修正了 12 個安全性問題。

此外也已更新 yast2-ntp-client 以符合某些 sntp 語法變更。
(bsc#937837)

已修正這些安全性問題：

- CVE-2015-8158：已修正 ntpq 中的潛在無限迴圈 (bsc#962966)。

- CVE-2015-8138：零來源時間戳記繞過 (bsc#963002)。

- CVE-2015-7979：對經驗證廣播模式發動的路徑外拒絕服務 (DoS) 攻擊 (bsc#962784)。

- CVE-2015-7978：限制清單遞迴遊走中的堆疊耗盡 (bsc#963000)。

- CVE-2015-7977：reslist NULL 指標解除參照 (bsc#962970)。

- CVE-2015-7976：ntpq saveconfig 命令允許在檔案名稱中存在危險字元 (bsc#962802)。

- CVE-2015-7975：nextvar() 遺漏長度檢查 (bsc#962988)。

- CVE-2015-7974：萬能金鑰：遺漏金鑰檢查允許在經驗證的對等端之間模擬 (bsc#962960)。

- CVE-2015-7973：對經驗證的廣播模式發動重播攻擊 (bsc#962995)。

- CVE-2015-8140：ntpq 容易遭受重播攻擊 (bsc#962994)。

- CVE-2015-8139：來源洩漏：ntpq 與 ntpdc，洩漏來源 (bsc#962997)。

- CVE-2015-5300：MITM 攻擊者可強制 ntpd 跨出大於錯誤閾值的一步 (bsc#951629)。

已修正下列非安全性錯誤：

- fate#320758 bsc#975981：針對 MS-SNTP 啟用編譯時間支援 (--enable-ntp-signd)。這會取代 4.2.4 中的 w32 修補程式，其新增了 authreg 指示詞。

- bsc#962318：以完整路徑呼叫 /usr/sbin/sntp 以在 start-ntpd 中同步。當以 cron 工作身分執行時，/usr/sbin/ 不在路徑中，其可造成同步失敗。

- bsc#782060：加速 ntpq。

- bsc#916617：新增 /var/db/ntp-kod。

- bsc#956773：新增 ntp-ENOBUFS.patch 以限制可能在載入系統上時常發生的警告。

- bsc#951559、bsc#975496：修正 sntp 在 DST 期間的 TZ 位移輸出。

- 新增 ntp-fork.patch 並在停用執行緒的情況下構建以允許即使在執行 chrooted 時也進行名稱解析。

此更新是從 SUSE:SLE-12-SP1:Update 更新專案匯入。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
91169	CentOS 6 : ntp (CESA-2016:0780)	Nessus	CentOS Local Security Checks	2016/5/17	2021/1/4	high
91539	Scientific Linux Security Update : ntp on SL6.x i386/x86_64 (20160510)	Nessus	Scientific Linux Local Security Checks	2016/6/9	2021/1/14	high
95330	CentOS 7 : ntp (CESA-2016:2583)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	high
90820	SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1175-1)	Nessus	SuSE Local Security Checks	2016/5/2	2021/1/19	high
91111	openSUSE Security Update : ntp (openSUSE-2016-578)	Nessus	SuSE Local Security Checks	2016/5/13	2021/1/19	high
92485	GLSA-201607-15 : NTP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2016/7/21	2021/1/11	critical
92546	Debian DLA-559-1 : ntp security update	Nessus	Debian Local Security Checks	2016/7/26	2021/1/11	high
88661	Amazon Linux AMI : ntp (ALAS-2016-649)	Nessus	Amazon Linux Local Security Checks	2016/2/10	2020/6/22	high
91248	SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1311-1)	Nessus	SuSE Local Security Checks	2016/5/19	2021/1/19	critical
91419	OracleVM 3.3 / 3.4 : ntp (OVMSA-2016-0082)	Nessus	OracleVM Local Security Checks	2016/6/1	2021/1/4	high
91403	openSUSE Security Update : ntp (openSUSE-2016-649)	Nessus	SuSE Local Security Checks	2016/6/1	2021/1/19	critical
88054	網路時間通訊協定程序 (ntpd) 3.x / 4.x < 4.2.8p6 多個弱點	Nessus	Misc.	2016/1/21	2025/2/18	medium
91169	CentOS 6：ntp (CESA-2016: 0780)	Nessus	CentOS Local Security Checks	2016/5/17	2021/1/4	high
91539	Scientific Linux 安全性更新：SL6.x i386/x86_64 上的 ntp	Nessus	Scientific Linux Local Security Checks	2016/6/9	2021/1/14	high
95330	CentOS 7：ntp (CESA-2016: 2583)	Nessus	CentOS Local Security Checks	2016/11/28	2021/1/4	high
93896	Ubuntu 14.04 LTS / 16.04 LTS：NTP 弱點 (USN-3096-1)	Nessus	Ubuntu Local Security Checks	2016/10/6	2025/9/3	high
90820	SUSE SLES11 安全性更新：ntp (SUSE-SU-2016:1175-1)	Nessus	SuSE Local Security Checks	2016/5/2	2021/1/19	high
91111	openSUSE 安全性更新：ntp (openSUSE-2016-578)	Nessus	SuSE Local Security Checks	2016/5/13	2021/1/19	high

检测

插件搜索

high

high

high

high

high

critical

high

high

critical

high

critical

medium

high

high

high

high

high

high