The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2018-2935:01 advisory.

    * ntp: Authenticated DoS via Malicious Config Option (CVE-2017-6463)
      * ntp: Denial of Service via Malformed Config (CVE-2017-6464)
      * ntp: Buffer Overflow in DPTS Clock (CVE-2017-6462)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2017-2400:02 advisory.

    * Two vulnerabilities were discovered in the NTP server's parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by sending a crafted message. (CVE-2017-6463,     CVE-2017-6464)
      * A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious     device could send crafted messages, causing ntpd to crash. (CVE-2017-6462)     Asianux would like to thank the NTP project for reporting these issues. Upstream acknowledges Cure53 as     the original reporter of these issues.
    CVE-2017-6462     Buffer overflow in the legacy Datum Programmable Time Server (DPTS)     refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows     local users to have unspecified impact via a crafted /dev/datum     device.
    CVE-2017-6463     NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote     authenticated users to cause a denial of service (daemon crash) via an     invalid setting in a :config directive, related to the unpeer option.
    CVE-2017-6464     NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to     cause a denial of service (ntpd crash) via a malformed mode     configuration directive.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-6464 CVE-2017-6462 CVE-2017-6463 CVE-2017-6458 CVE-2017-6451.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This ntp update to version 4.2.8p10 fixes serveral issues. This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details. Security issues fixed (bsc#1030050) :

  - CVE-2017-6464: Denial of Service via Malformed Config

  - CVE-2017-6462: Buffer Overflow in DPTS Clock

  - CVE-2017-6463: Authenticated DoS via Malicious Config     Option

  - CVE-2017-6458: Potential Overflows in ctl_put()     functions

  - CVE-2017-6451: Improper use of snprintf() in     mx4200_send()

  - CVE-2017-6460: Buffer Overflow in ntpq when fetching     reslist

  - CVE-2016-9042: 0rigin (zero origin) DoS.

  - ntpq_stripquotes() returns incorrect Value

  - ereallocarray()/eallocarray() underused

  - Copious amounts of Unused Code

  - Off-by-one in Oncore GPS Receiver

  - Makefile does not enforce Security Flags Bugfixes :

  - Remove spurious log messages (bsc#1014172).

  - clang scan-build findings

  - Support for openssl-1.1.0 without compatibility modes

  - Bugfix 3072 breaks multicastclient

  - forking async worker: interrupted pipe I/O

  - (...) time_pps_create: Exec format error

  - Incorrect Logic for Peer Event Limiting

  - Change the process name of forked DNS worker

  - Trap Configuration Fail

  - Nothing happens if minsane 

  - allow -4/-6 on restrict line with mask

  - out-of-bound pointers in ctl_putsys and decode_bitflags

  - Move ntp-kod to /var/lib/ntp, because /var/db is not a     standard directory and causes problems for transactional     updates.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This ntp update to version 4.2.8p10 fixes the following issues:
Security issues fixed (bsc#1030050) :

  - CVE-2017-6464: Denial of Service via Malformed Config

  - CVE-2017-6462: Buffer Overflow in DPTS Clock

  - CVE-2017-6463: Authenticated DoS via Malicious Config     Option

  - CVE-2017-6458: Potential Overflows in ctl_put()     functions

  - CVE-2017-6451: Improper use of snprintf() in     mx4200_send()

  - CVE-2017-6460: Buffer Overflow in ntpq when fetching     reslist

  - CVE-2016-9042: 0rigin (zero origin) DoS.

  - ntpq_stripquotes() returns incorrect Value

  - ereallocarray()/eallocarray() underused

  - Copious amounts of Unused Code

  - Off-by-one in Oncore GPS Receiver

  - Makefile does not enforce Security Flags Bugfixes :

  - Remove spurious log messages (bsc#1014172).

  - Fixing ppc and ppc64 linker issue (bsc#1031085).

  - clang scan-build findings

  - Support for openssl-1.1.0 without compatibility modes

  - Bugfix 3072 breaks multicastclient

  - forking async worker: interrupted pipe I/O

  - (...) time_pps_create: Exec format error

  - Incorrect Logic for Peer Event Limiting

  - Change the process name of forked DNS worker

  - Trap Configuration Fail

  - Nothing happens if minsane 

  - allow -4/-6 on restrict line with mask

  - out-of-bound pointers in ctl_putsys and decode_bitflags

  - Move ntp-kod to /var/lib/ntp, because /var/db is not a     standard directory and causes problems for transactional     updates.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, 10.12.x prior to 10.12.6, or is not macOS 10.13. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - AppSandbox
  - AppleScript
  - Application Firewall
  - ATS
  - Audio
  - CFNetwork
  - CFNetwork Proxies
  - CFString
  - Captive Network Assistant
  - CoreAudio
  - CoreText
  - DesktopServices
  - Directory Utility
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - IOFireWireFamily
  - ImageIO
  - Installer
  - Kernel
  - kext tools
  - libarchive
  - libc
  - libexpat
  - Mail
  - Mail Drafts
  - ntp
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - SQLite
  - Sandbox
  - Screen Lock
  - Security
  - Spotlight
  - WebKit
  - zlib

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Security fix for CVE-2017-6464 CVE-2017-6462 CVE-2017-6463 CVE-2017-6458 CVE-2017-6451 CVE-2017-6460 CVE-2016-9042.

----

This update improves the default configuration file to use the pool directive. It also replaces the ntpstat program with a shell script that uses the ntpq program instead of implementing the mode 6 protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for ntp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* Two vulnerabilities were discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. (CVE-2017-6463, CVE-2017-6464)

* A vulnerability was found in NTP, in the parsing of packets from the /dev/ datum device. A malicious device could send crafted messages, causing ntpd to crash. (CVE-2017-6462)

Red Hat would like to thank the NTP project for reporting these issues. Upstream acknowledges Cure53 as the original reporter of these issues.

An update for ntp is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* ntp: Authenticated DoS via Malicious Config Option (CVE-2017-6463)

* ntp: Denial of Service via Malformed Config (CVE-2017-6464)

* ntp: Buffer Overflow in DPTS Clock (CVE-2017-6462)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the NTP project for reporting these issues. Upstream acknowledges Cure53 as the original reporter of these issues.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Security Fix(es) :

  - ntp: Authenticated DoS via Malicious Config Option     (CVE-2017-6463)

  - ntp: Denial of Service via Malformed Config     (CVE-2017-6464)

  - ntp: Buffer Overflow in DPTS Clock (CVE-2017-6462)

Additional Changes :

An update for ntp is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.

Security Fix(es) :

* Two vulnerabilities were discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. (CVE-2017-6463, CVE-2017-6464)

* A vulnerability was found in NTP, in the parsing of packets from the /dev/ datum device. A malicious device could send crafted messages, causing ntpd to crash. (CVE-2017-6462)

Red Hat would like to thank the NTP project for reporting these issues. Upstream acknowledges Cure53 as the original reporter of these issues.

Note that Tenable Network Security has attempted to extract the preceding description block directly from the corresponding Red Hat security advisory. Virtuozzo provides no description for VZLSA advisories. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 4.05, has ntp packages installed that are affected by multiple vulnerabilities:

  - A vulnerability was found in NTP, in the parsing of     packets from the /dev/datum device. A malicious device     could send crafted messages, causing ntpd to crash.
    (CVE-2017-6462)

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message. (CVE-2017-6463,     CVE-2017-6464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Denial of Service via Malformed Config :

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message.(CVE-2017-6464)

Potential Overflows in ctl_put() functions :

A vulnerability was found in NTP, in the building of response packets with custom fields. If custom fields were configured in ntp.conf with particularly long names, inclusion of these fields in the response packet could cause a buffer overflow, leading to a crash.
(CVE-2017-6458)

Improper use of snprintf() in mx4200_send() :

A vulnerability was found in NTP, in the legacy MX4200 refclock implementation. If this refclock was compiled in and used, an attacker may be able to induce stack overflow, leading to a crash or potential code execution.(CVE-2017-6451)

Authenticated DoS via Malicious Config Option :

A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message.(CVE-2017-6463)

Buffer Overflow in DPTS Clock :

A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash.(CVE-2017-6462)

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050) :

  - CVE-2017-6464: Denial of Service via Malformed Config

  - CVE-2017-6462: Buffer Overflow in DPTS Clock

  - CVE-2017-6463: Authenticated DoS via Malicious Config     Option

  - CVE-2017-6458: Potential Overflows in ctl_put()     functions

  - CVE-2017-6451: Improper use of snprintf() in     mx4200_send()

  - CVE-2017-6460: Buffer Overflow in ntpq when fetching     reslist

  - CVE-2016-9042: 0rigin (zero origin) DoS.

  - ntpq_stripquotes() returns incorrect Value

  - ereallocarray()/eallocarray() underused

  - Copious amounts of Unused Code

  - Off-by-one in Oncore GPS Receiver

  - Makefile does not enforce Security Flags

Bugfixes :

  - Remove spurious log messages (bsc#1014172).

  - clang scan-build findings

  - Support for openssl-1.1.0 without compatibility modes

  - Bugfix 3072 breaks multicastclient

  - forking async worker: interrupted pipe I/O

  - (...) time_pps_create: Exec format error

  - Incorrect Logic for Peer Event Limiting

  - Change the process name of forked DNS worker

  - Trap Configuration Fail

  - Nothing happens if minsane < maxclock < minclock

  - allow -4/-6 on restrict line with mask

  - out-of-bound pointers in ctl_putsys and decode_bitflags

  - Move ntp-kod to /var/lib/ntp, because /var/db is not a     standard directory and causes problems for transactional     updates.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
289684	MiracleLinux 7 : ntp-4.2.6p5-28.0.1.el7.AXS7 (AXSA:2018-2935:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
289987	MiracleLinux 4 : ntp-4.2.6p5-12.1.0.1.AXS4 (AXSA:2017-2400:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
99445	Fedora 24 : ntp (2017-72323a442f)	Nessus	Fedora Local Security Checks	2017/4/19	2025/12/25	high
99467	SUSE SLES12 Security Update : ntp (SUSE-SU-2017:1047-1)	Nessus	SuSE Local Security Checks	2017/4/19	2025/12/25	high
99469	SUSE SLES11 Security Update : ntp (SUSE-SU-2017:1052-1)	Nessus	SuSE Local Security Checks	2017/4/19	2025/12/25	high
103598	macOS < 10.13 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2017/10/3	2025/11/19	critical
101588	Fedora 26 : ntp (2017-20d54b2782)	Nessus	Fedora Local Security Checks	2017/7/17	2025/12/10	high
104217	CentOS 6 : ntp (CESA-2017:3071)	Nessus	CentOS Local Security Checks	2017/10/30	2021/1/4	high
109375	CentOS 7 : ntp (CESA-2018:0855)	Nessus	CentOS Local Security Checks	2018/4/27	2024/10/22	high
109453	Scientific Linux Security Update : ntp on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	2018/5/1	2024/10/16	high
119235	Virtuozzo 6 : ntp / ntp-doc / ntp-perl / ntpdate (VZLSA-2017-3071)	Nessus	Virtuozzo Local Security Checks	2018/11/27	2024/7/18	high
127378	NewStart CGSL MAIN 4.05 : ntp Multiple Vulnerabilities (NS-SA-2019-0127)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	high
99529	Amazon Linux AMI : ntp (ALAS-2017-816)	Nessus	Amazon Linux Local Security Checks	2017/4/21	2025/12/25	high
99700	openSUSE Security Update : ntp (openSUSE-2017-511)	Nessus	SuSE Local Security Checks	2017/4/27	2025/12/23	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

high

high

high

high