Red Hat Security Advisory

RHSA-2015:0104

ntp security update

Released 2015-01-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5) ntp-4.2.6p5-2.el6_5, ntp-doc-4.2.6p5-2.el6_5, ntp-perl-4.2.6p5-2.el6_5
Red Hat Enterprise Linux HPC Node EUS (v. 6.5) ntp-4.2.6p5-2.el6_5, ntpdate-4.2.6p5-2.el6_5
Red Hat Enterprise Linux Server EUS (v. 6.5) ntp-4.2.6p5-2.el6_5, ntpdate-4.2.6p5-2.el6_5
Red Hat Enterprise Linux Server Optional EUS (v. 6.5) ntp-4.2.6p5-2.el6_5, ntp-doc-4.2.6p5-2.el6_5, ntp-perl-4.2.6p5-2.el6_5

Fixes 4 records

TI-2014-07543 CVE-2014-9295 · GHSA-67hp-c7g3-34pp

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers…

HIGH 73

Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.79069 Published 2014-12-20 Partial fix CWE-119

TI-2014-07542 CVE-2014-9294 · GHSA-5385-7g23-qh96

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes…

MEDIUM 47

util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.12978 Published 2014-12-20 Partial fix

TI-2014-07541 CVE-2014-9293 · GHSA-39gg-qjj7-qm8m

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not…

MEDIUM 47

The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brut…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.12978 Published 2014-12-20 Fixed

TI-2014-07544 CVE-2014-9296 · GHSA-9prp-4cr8-gqhf

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute…

LOW 39

The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via craf…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.16161 Published 2014-12-20 Fixed CWE-17