Red Hat Security AdvisoryRHSA-2016:0780
ntp security and bug fix update
Released 2016-05-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
- Red Hat Enterprise Linux HPC Node (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
- Red Hat Enterprise Linux Server (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
- Red Hat Enterprise Linux Server Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
- Red Hat Enterprise Linux Workstation (v. 6) ntp-4.2.6p5-10.el6, ntpdate-4.2.6p5-10.el6
- Red Hat Enterprise Linux Workstation Optional (v. 6) ntp-doc-4.2.6p5-10.el6, ntp-perl-4.2.6p5-10.el6
Fixes 11 records
Priority MEDIUM 45
NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.09905 · Published 2017-01-30 · Partial fix CWE-400
Priority MEDIUM 44
ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.08753 · Published 2017-07-21 · Partial fix CWE-20
Priority MEDIUM 43
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.07103 · Published 2017-08-07 · Partial fix CWE-20
Priority MEDIUM 42
Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06519 · Published 2017-08-07 · Partial fix CWE-772
Priority MEDIUM 42
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06519 · Published 2017-08-07 · Partial fix CWE-20
Priority MEDIUM 42
The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a craft…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.06089 · Published 2017-07-21 · Partial fix CWE-704
Priority MEDIUM 42
The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.06483 · Published 2017-07-21 · Partial fix CWE-20
Priority MEDIUM 40
ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.12282 · Published 2017-08-07 · Partial fix CWE-20
Priority LOW 39
The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03823 · Published 2017-07-24 · Partial fix CWE-20
Priority LOW 37
The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash).
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.05207 · Published 2017-08-07 · Partial fix CWE-20
Priority LOW 36
ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.06295 · Published 2017-01-30 · Partial fix CWE-476
THREATIST.IORead the docs