The version of NTP installed on the remote AIX host is affected by the following vulnerabilities :

  - A time serving flaw exists in the trusted key system     due to improper key checks. An authenticated, remote     attacker can exploit this to perform impersonation     attacks between authenticated peers. (CVE-2015-7974)

  - A denial of service vulnerability exists due to improper     handling of a crafted Crypto NAK Packet with a source     address spoofed to match that of an existing associated     peer. An unauthenticated, remote attacker can exploit     this to demobilize a client association. (CVE-2016-1547)

  - An information disclosure vulnerability exists in the     message authentication functionality in libntp that is     triggered during the handling of a series of specially     crafted messages. An adjacent attacker can exploit this     to partially recover the message digest key.
    (CVE-2016-1550)

  - A flaw exists due to improper filtering of IPv4 'bogon'     packets received from a network. An unauthenticated,     remote attacker can exploit this to spoof packets to     appear to come from a specific reference clock.
    (CVE-2016-1551)

  - A denial of service vulnerability exists that allows an     authenticated, remote attacker to manipulate the value     of the trustedkey, controlkey, or requestkey via a     crafted packet, preventing authentication with ntpd     until the daemon has been restarted. (CVE-2016-2517)

  - An out-of-bounds read error exists in the MATCH_ASSOC()     function that occurs during the creation of peer     associations with hmode greater than 7. An     authenticated, remote attacker can exploit this, via a     specially crafted packet, to cause a denial of service.
    (CVE-2016-2518)

  - An overflow condition exists in the ctl_getitem()     function in ntpd due to improper validation of     user-supplied input when reporting return values. An     authenticated, remote attacker can exploit this to cause     ntpd to abort. (CVE-2016-2519)

  - A denial of service vulnerability exists when handling     authentication due to improper packet timestamp checks.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted and spoofed packet, to     demobilize the ephemeral associations. (CVE-2016-4953)

  - A flaw exists that is triggered when handling spoofed     packets. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to affect peer     variables (e.g., cause leap indications to be set). Note     that the attacker must be able to spoof packets with     correct origin timestamps from servers before expected     response packets arrive. (CVE-2016-4954)

  - A flaw exists that is triggered when handling spoofed     packets. An unauthenticated, remote attacker can exploit     this, via specially crafted packets, to reset autokey     associations. Note that the attacker must be able to     spoof packets with correct origin timestamps from     servers before expected response packets arrive.
    (CVE-2016-4955)

  - A denial of service vulnerability exists when handling     CRYPTO_NAK packets that allows an unauthenticated,     remote attacker to cause a crash. (CVE-2016-4957)

The version of the remote NTP server is 3.x or 4.x prior to 4.2.8p7.
It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists due to improper     validation of the origin timestamp field when handling a     Kiss-of-Death (KoD) packet. An unauthenticated, remote     attacker can exploit this to cause a client to stop     querying its servers, preventing the client from     updating its clock. (CVE-2015-7704)

  - A flaw exists in the receive() function in ntp_proto.c     that allows packets with an origin timestamp of zero to     bypass security checks. An unauthenticated, remote     attacker can exploit this to spoof arbitrary content.
    (CVE-2015-8138)

  - A denial of service vulnerability exists due to improper     handling of a crafted Crypto NAK Packet with a source     address spoofed to match that of an existing associated     peer. An unauthenticated, remote attacker can exploit     this to demobilize a client association. (CVE-2016-1547)

  - A denial of service vulnerability exists due to improper     handling of packets spoofed to appear to be from a valid     ntpd server. An unauthenticated, remote attacker can     exploit this to cause NTP to switch from basic     client/server mode to interleaved symmetric mode,     causing the client to reject future legitimate     responses. (CVE-2016-1548)

  - A race condition exists that is triggered during the     handling of a saturation of ephemeral associations. An     authenticated, remote attacker can exploit this to     defeat NTP's clock selection algorithm and modify a     user's clock. (CVE-2016-1549)

  - An information disclosure vulnerability exists in the     message authentication functionality in libntp that is     triggered during the handling of a series of specially     crafted messages. An adjacent attacker can exploit this     to partially recover the message digest key.
    (CVE-2016-1550)

  - A flaw exists due to improper filtering of IPv4 'bogon'     packets received from a network. An unauthenticated,     remote attacker can exploit this to spoof packets to     appear to come from a specific reference clock.
    (CVE-2016-1551)

  - A denial of service vulnerability exists that allows an     authenticated, remote attacker that has knowledge of the     controlkey for ntpq or the requestkey for ntpdc to     create a session with the same IP twice on an     unconfigured directive line, causing ntpd to abort.
    (CVE-2016-2516)

  - A denial of service vulnerability exists that allows an     authenticated, remote attacker to manipulate the value     of the trustedkey, controlkey, or requestkey via a     crafted packet, preventing authentication with ntpd     until the daemon has been restarted. (CVE-2016-2517)

  - An out-of-bounds read error exists in the MATCH_ASSOC()     function that occurs during the creation of peer     associations with hmode greater than 7. An     authenticated, remote attacker can exploit this, via a     specially crafted packet, to cause a denial of service.
    (CVE-2016-2518)

  - An overflow condition exists in the ctl_getitem()     function in ntpd due to improper validation of     user-supplied input when reporting return values. An     authenticated, remote attacker can exploit this to cause     ntpd to abort. (CVE-2016-2519)

NTP was updated to version 4.2.8p8 to fix several security issues and to ensure the continued maintainability of the package.

These security issues were fixed :

CVE-2016-4953: Bad authentication demobilized ephemeral associations (bsc#982065).

CVE-2016-4954: Processing spoofed server packets (bsc#982066).

CVE-2016-4955: Autokey association reset (bsc#982067).

CVE-2016-4956: Broadcast interleave (bsc#982068).

CVE-2016-4957: CRYPTO_NAK crash (bsc#982064).

CVE-2016-1547: Validate crypto-NAKs to prevent ACRYPTO-NAK DoS (bsc#977459).

CVE-2016-1548: Prevent the change of time of an ntpd client or denying service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode (bsc#977461).

CVE-2016-1549: Sybil vulnerability: ephemeral association attack (bsc#977451).

CVE-2016-1550: Improve security against buffer comparison timing attacks (bsc#977464).

CVE-2016-1551: Refclock impersonation vulnerability (bsc#977450)y

CVE-2016-2516: Duplicate IPs on unconfig directives could have caused an assertion botch in ntpd (bsc#977452).

CVE-2016-2517: Remote configuration trustedkey/ requestkey/controlkey values are not properly validated (bsc#977455).

CVE-2016-2518: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC (bsc#977457).

CVE-2016-2519: ctl_getitem() return value not always checked (bsc#977458).

CVE-2015-8158: Potential Infinite Loop in ntpq (bsc#962966).

CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).

CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode (bsc#962784).

CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list (bsc#963000).

CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).

CVE-2015-7976: ntpq saveconfig command allowed dangerous characters in filenames (bsc#962802).

CVE-2015-7975: nextvar() missing length check (bsc#962988).

CVE-2015-7974: NTP did not verify peer associations of symmetric keys when authenticating packets, which might have allowed remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a 'skeleton' key (bsc#962960).

CVE-2015-7973: Replay attack on authenticated broadcast mode (bsc#962995).

CVE-2015-5300: MITM attacker can force ntpd to make a step larger than the panic threshold (bsc#951629).

CVE-2015-5194: Crash with crafted logconfig configuration command (bsc#943218).

CVE-2015-7871: NAK to the Future: Symmetric association authentication bypass via crypto-NAK (bsc#952611).

CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values (bsc#952611).

CVE-2015-7854: Password Length Memory Corruption Vulnerability (bsc#952611).

CVE-2015-7853: Invalid length data provided by a custom refclock driver could cause a buffer overflow (bsc#952611).

CVE-2015-7852: ntpq atoascii() Memory Corruption Vulnerability (bsc#952611).

CVE-2015-7851: saveconfig Directory Traversal Vulnerability (bsc#952611).

CVE-2015-7850: Clients that receive a KoD now validate the origin timestamp field (bsc#952611).

CVE-2015-7849: Prevent use-after-free trusted key (bsc#952611).

CVE-2015-7848: Prevent mode 7 loop counter underrun (bsc#952611).

CVE-2015-7701: Slow memory leak in CRYPTO_ASSOC (bsc#952611).

CVE-2015-7703: Configuration directives 'pidfile' and 'driftfile' should only be allowed locally (bsc#943221).

CVE-2015-7704: Clients that receive a KoD should validate the origin timestamp field (bsc#952611).

CVE-2015-7705: Clients that receive a KoD should validate the origin timestamp field (bsc#952611).

CVE-2015-7691: Incomplete autokey data packet length checks (bsc#952611).

CVE-2015-7692: Incomplete autokey data packet length checks (bsc#952611).

CVE-2015-7702: Incomplete autokey data packet length checks (bsc#952611).

CVE-2015-1798: The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP required a correct MAC only if the MAC field has a nonzero length, which made it easier for man-in-the-middle attackers to spoof packets by omitting the MAC (bsc#924202).

CVE-2015-1799: The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP performed state-variable updates upon receiving certain invalid packets, which made it easier for man-in-the-middle attackers to cause a denial of service (synchronization loss) by spoofing the source IP address of a peer (bsc#924202).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-476:01 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's     time with another reference time source. This package includes ntpd     (a daemon which continuously adjusts system time) and utilities used     to query and configure the ntpd daemon.
    Perl scripts ntp-wait and ntptrace are in the ntp-perl package,     ntpdate is in the ntpdate package and sntp is in the sntp package.
    The documentation is in the ntp-doc package.
    Security issues fixed with this release:
    CVE-2015-7979
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-1547
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-1548
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-1550
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    CVE-2016-2518
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for ntp to 4.2.8p7 fixes the following issues :

  - CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA:
    CRYPTO-NAK DoS.

  - CVE-2016-1548, bsc#977461: Interleave-pivot

  - CVE-2016-1549, bsc#977451: Sybil vulnerability:
    ephemeral association attack.

  - CVE-2016-1550, bsc#977464: Improve NTP security against     buffer comparison timing attacks.

  - CVE-2016-1551, bsc#977450: Refclock impersonation     vulnerability

  - CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig     directives will cause an assertion botch in ntpd.

  - CVE-2016-2517, bsc#977455: remote configuration     trustedkey/ requestkey/controlkey values are not     properly validated.

  - CVE-2016-2518, bsc#977457: Crafted addpeer with hmode >     7 causes array wraparound with MATCH_ASSOC.

  - CVE-2016-2519, bsc#977458: ctl_getitem() return value     not always checked.

  - This update also improves the fixes for: CVE-2015-7704,     CVE-2015-7705, CVE-2015-7974

Bugs fixed :

  - Restrict the parser in the startup script to the first     occurrance of 'keys' and 'controlkey' in ntp.conf     (bsc#957226).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that when ntp is configured with rate     limiting for all associations the limits are also     applied to responses received from its configured     sources. A remote attacker who knows the sources can     cause a denial of service by preventing ntpd from     accepting valid responses from its     sources.(CVE-2016-7426)

  - ntpq in NTP before 4.2.8p7 allows remote attackers to     obtain origin timestamps and then impersonate peers via     unspecified vectors.(CVE-2015-8139)

  - A NULL pointer dereference flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could potentially use this flaw to     crash ntpd.(CVE-2015-7977)

  - A vulnerability was found in NTP, in the parsing of     packets from the /dev/datum device. A malicious device     could send crafted messages, causing ntpd to     crash.(CVE-2017-6462)

  - The process_packet function in ntp_proto.c in ntpd in     NTP 4.x before 4.2.8p8 allows remote attackers to cause     a denial of service (peer-variable modification) by     sending spoofed packets from many source IP addresses     in a certain scenario, as demonstrated by triggering an     incorrect leap indication.(CVE-2016-4954)

  - It was found that ntpd could crash due to an     uninitialized variable when processing malformed     logconfig configuration commands.(CVE-2015-5194)

  - It was discovered that the sntp utility could become     unresponsive due to being caught in an infinite loop     when processing a crafted NTP packet.(CVE-2015-5219)

  - It was discovered that ntpd as a client did not     correctly check the originate timestamp in received     packets. A remote attacker could use this flaw to send     a crafted packet to an ntpd client that would     effectively disable synchronization with the server, or     push arbitrary offset/delay measurements to modify the     time on the client.(CVE-2015-8138)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7702)

  - Multiple buffer overflow flaws were discovered in     ntpd's crypto_recv(), ctl_putdata(), and configure()     functions. A remote attacker could use either of these     flaws to send a specially crafted request packet that     could crash ntpd or, potentially, execute arbitrary     code with the privileges of the ntp user. Note: the     crypto_recv() flaw requires non default configurations     to be active, while the ctl_putdata() flaw, by default,     can only be exploited via local attackers, and the     configure() flaw requires additional authentication to     exploit.(CVE-2014-9295)

  - It was found that an ntpd client could be forced to     change from basic client/server mode to the interleaved     symmetric mode. A remote attacker could use a spoofed     packet that, when processed by an ntpd client, would     cause that client to reject all future legitimate     server responses, effectively disabling time     synchronization on that client.(CVE-2016-1548)

  - A flaw was found in the way NTP's libntp performed     message authentication. An attacker able to observe the     timing of the comparison function used in packet     authentication could potentially use this flaw to     recover the message digest.(CVE-2016-1550)

  - A denial of service flaw was found in the way NTP     handled preemptable client associations. A remote     attacker could send several crypto NAK packets to a     victim client, each with a spoofed source address of an     existing associated peer, preventing that client from     synchronizing its time.(CVE-2016-1547)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7692)

  - A flaw was found in the way the ntpq client processed     certain incoming packets in a loop in the getresponse()     function. A remote attacker could potentially use this     flaw to crash an ntpq client instance.(CVE-2015-8158)

  - It was discovered that ntpd as a client did not     correctly check timestamps in Kiss-of-Death packets. A     remote attacker could use this flaw to send a crafted     Kiss-of-Death packet to an ntpd client that would     increase the client's polling interval value, and     effectively disable synchronization with the     server.(CVE-2015-7704)

  - A flaw was found in the control mode functionality of     ntpd. A remote attacker could send a crafted control     mode packet which could lead to information disclosure     or result in DDoS amplification attacks.(CVE-2016-9310)

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message.(CVE-2017-6464)

  - It was found that ntpd automatically generated weak     keys for its internal use if no ntpdc request     authentication key was specified in the ntp.conf     configuration file. A remote attacker able to match the     configured IP restrictions could guess the generated     key, and possibly use it to send ntpdc query or     configuration requests.(CVE-2014-9293)

  - A denial of service flaw was found in the way NTP hosts     that were peering with each other authenticated     themselves before updating their internal state     variables. An attacker could send packets to one peer     host, which could cascade to other peers, and stop the     synchronization process among the reached     peers.(CVE-2015-1799)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for ntp fixes the following issues :

  - Update to 4.2.8p7 (boo#977446) :

  - CVE-2016-1547, boo#977459: Validate crypto-NAKs, AKA:
    CRYPTO-NAK DoS.

  - CVE-2016-1548, boo#977461: Interleave-pivot

  - CVE-2016-1549, boo#977451: Sybil vulnerability:
    ephemeral association attack.

  - CVE-2016-1550, boo#977464: Improve NTP security against     buffer comparison timing attacks.

  - CVE-2016-1551, boo#977450: Refclock impersonation     vulnerability

  - CVE-2016-2516, boo#977452: Duplicate IPs on unconfig     directives will cause an assertion botch in ntpd.

  - CVE-2016-2517, boo#977455: remote configuration     trustedkey/ requestkey/controlkey values are not     properly validated.

  - CVE-2016-2518, boo#977457: Crafted addpeer with hmode >     7 causes array wraparound with MATCH_ASSOC.

  - CVE-2016-2519, boo#977458: ctl_getitem() return value     not always checked.

  - integrate ntp-fork.patch

  - Improve the fixes for: CVE-2015-7704, CVE-2015-7705,     CVE-2015-7974

  - Restrict the parser in the startup script to the first     occurrance of 'keys' and 'controlkey' in ntp.conf     (boo#957226).

  - Enable compile-time support for MS-SNTP     (--enable-ntp-signd). This replaces the w32 patches in     4.2.4 that added the authreg directive. (fate#320758).

  - Fix ntp-sntp-dst.patch (boo#975496).

  - Call /usr/sbin/sntp with full path to synchronize in     start-ntpd. When run as cron job, /usr/sbin/ is not in     the path, which caused the synchronization to fail.
    (boo#962318)

  - Speedup ntpq (boo#782060, ntp-speedup-ntpq.patch).

  - Sync service files with openSUSE Factory.

  - Fix the TZ offset output of sntp during DST     (boo#951559).

  - Add ntp-fork.patch and build with threads disabled to     allow name resolution even when running chrooted.

  - Update to 4.2.8p6 :

  - CVE-2015-8158, boo#962966: Potential Infinite Loop in     ntpq.

  - CVE-2015-8138, boo#963002: origin: Zero Origin Timestamp     Bypass.

  - CVE-2015-7979, boo#962784: Off-path Denial of Service     (DoS) attack on authenticated broadcast mode.

  - CVE-2015-7978, boo#963000: Stack exhaustion in recursive     traversal of restriction list.

  - CVE-2015-7977, boo#962970: reslist NULL pointer     dereference.

  - CVE-2015-7976, boo#962802: ntpq saveconfig command     allows dangerous characters in filenames.

  - CVE-2015-7975, boo#962988: nextvar() missing length     check.

  - CVE-2015-7974, boo#962960: Skeleton Key: Missing key     check allows impersonation between authenticated peers.

  - CVE-2015-7973, boo#962995: Deja Vu: Replay attack on     authenticated broadcast mode.

  - CVE-2015-8140: ntpq vulnerable to replay attacks.

  - CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose     origin.

  - CVE-2015-5300, boo#951629: Small-step/Big-step.

  - Add /var/db/ntp-kod (boo#916617).

  - Add ntp-ENOBUFS.patch to limit a warning that might     happen quite a lot on loaded systems (boo#956773).

  - add ntp.bug2965.diff (boo#954982)

  - fixes regression in 4.2.8p4 update

  - Update to 4.2.8p4 to fix several security issues     (boo#951608) :

  - CVE-2015-7871: NAK to the Future: Symmetric association     authentication bypass via crypto-NAK

  - CVE-2015-7855: decodenetnum() will ASSERT botch instead     of returning FAIL on some bogus values

  - CVE-2015-7854: Password Length Memory Corruption     Vulnerability

  - CVE-2015-7853: Invalid length data provided by a custom     refclock driver could cause a buffer overflow

  - CVE-2015-7852 ntpq atoascii() Memory Corruption     Vulnerability

  - CVE-2015-7851 saveconfig Directory Traversal     Vulnerability

  - CVE-2015-7850 remote config logfile-keyfile

  - CVE-2015-7849 trusted key use-after-free

  - CVE-2015-7848 mode 7 loop counter underrun

  - CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC

  - CVE-2015-7703 configuration directives 'pidfile' and     'driftfile' should only be allowed locally

  - CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD     should validate the origin timestamp field

  - CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete     autokey data packet length checks

  - obsoletes ntp-memlock.patch.

  - Add a controlkey line to /etc/ntp.conf if one does not     already exist to allow runtime configuuration via ntpq.

  - Temporarily disable memlock to avoid problems due to     high memory usage during name resolution (boo#946386,     ntp-memlock.patch).

  - Use SHA1 instead of MD5 for symmetric keys (boo#905885).

  - Improve runtime configuration :

  - Read keytype from ntp.conf

  - Don't write ntp keys to syslog.

  - Fix legacy action scripts to pass on command line     arguments.

  - Remove ntp.1.gz, it wasn't installed anymore.

  - Remove ntp-4.2.7-rh-manpages.tar.gz and only keep     ntptime.8.gz. The rest is partially irrelevant,     partially redundant and potentially outdated     (boo#942587).

  - Remove 'kod' from the restrict line in ntp.conf     (boo#944300).

  - Use ntpq instead of deprecated ntpdc in start-ntpd     (boo#936327).

  - Add a controlkey to ntp.conf to make the above work.

  - Don't let 'keysdir' lines in ntp.conf trigger the 'keys'     parser.

  - Disable mode 7 (ntpdc) again, now that we don't use it     anymore.

  - Add 'addserver' as a new legacy action.

  - Fix the comment regarding addserver in ntp.conf     (boo#910063).

  - Update to version 4.2.8p3 which incorporates all     security fixes and most other patches we have so far     (fate#319040). More information on:
    http://archive.ntp.org/ntp4/ChangeLog-stable

  - Disable chroot by default (boo#926510).

  - Enable ntpdc for backwards compatibility (boo#920238).

  - Security fix: ntp-keygen may generate non-random     symmetric keys

Several vulnerabilities were discovered in the Network Time Protocol daemon and utility programs :

CVE-2015-7974

Matt Street discovered that insufficient key validation allows impersonation attacks between authenticated peers.

CVE-2015-7977 / CVE-2015-7978

Stephen Gray discovered that a NULL pointer dereference and a buffer overflow in the handling of 'ntpdc reslist' commands may result in denial of service.

CVE-2015-7979

Aanchal Malhotra discovered that if NTP is configured for broadcast mode, an attacker can send malformed authentication packets which break associations with the server for other broadcast clients.

CVE-2015-8138

Matthew van Gundy and Jonathan Gardner discovered that missing validation of origin timestamps in ntpd clients may result in denial of service.

CVE-2015-8158

Jonathan Gardner discovered that missing input sanitising in ntpq may result in denial of service.

CVE-2016-1547

Stephen Gray and Matthew van Gundy discovered that incorrect handling of crypto NAK packets my result in denial of service.

CVE-2016-1548

Jonathan Gardner and Miroslav Lichvar discovered that ntpd clients could be forced to change from basic client/server mode to interleaved symmetric mode, preventing time synchronisation.

CVE-2016-1550

Matthew van Gundy, Stephen Gray and Loganaden Velvindron discovered that timing leaks in the the packet authentication code could result in recovery of a message digest.

CVE-2016-2516

Yihan Lian discovered that duplicate IPs on 'unconfig' directives will trigger an assert.

CVE-2016-2518

Yihan Lian discovered that an OOB memory access could potentially crash ntpd.

For Debian 7 'Wheezy', these problems have been fixed in version 1:4.2.6.p5+dfsg-2+deb7u7.

We recommend that you upgrade your ntp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the version of Junos Space running on the remote device is < 17.1R1, and is therefore affected by multiple vulnerabilities.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
99183	AIX NTP v4 Advisory : ntp_advisory7.asc (IV87278) (IV87279)	Nessus	AIX Local Security Checks	2017/4/4	2025/12/26	high
90923	Network Time Protocol Daemon (ntpd) 3.x / 4.x < 4.2.8p7 Multiple Vulnerabilities	Nessus	Misc.	2016/5/5	2019/11/19	critical
93186	SUSE SLES10 Security Update : ntp (SUSE-SU-2016:1912-1)	Nessus	SuSE Local Security Checks	2016/8/29	2026/1/27	critical
290121	MiracleLinux 7 : ntp-4.2.6p5-22.2.0.1.el7.AXS7 (AXSA:2016-476:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
91120	SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1278-1)	Nessus	SuSE Local Security Checks	2016/5/13	2021/1/19	critical
125008	EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1555)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	high
91403	openSUSE Security Update : ntp (openSUSE-2016-649)	Nessus	SuSE Local Security Checks	2016/6/1	2021/1/19	critical
92546	Debian DLA-559-1 : ntp security update	Nessus	Debian Local Security Checks	2016/7/26	2026/1/30	high
104100	Juniper Junos Space < 17.1R1 Multiple Vulnerabilities (JSA10826)	Nessus	Junos Local Security Checks	2017/10/23	2023/3/30	critical

检测

插件搜索

high

critical

critical

high

critical

high

critical

high

critical