Multiple vulnerabilities have been discovered in NTP, the worst of which could lead to the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8_p16 | >= 4.2.8_p16 |
NTP contains software for the Network Time Protocol.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
The first four of these CVEs affect a function in libntp that is only used by ntpq, but not by ntpd. The last CVE affects the driver for a hardware clock (GPS receiver), so ntpd might be vulnerable to manipulated devices of that type, but not to remote attacks.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p16"
Multiple vulnerabilities have been found in NTP, the worst of which could result in a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8_p15 | >= 4.2.8_p15 |
NTP contains software for the Network Time Protocol.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p15"
Multiple vulnerabilities have been found in NTP, the worst of which could result in the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8_p13 | >= 4.2.8_p13 |
NTP contains software for the Network Time Protocol.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
An attacker could cause a Denial of Service condition, escalate privileges, or remotely execute arbitrary code.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p13"
Multiple vulnerabilities have been found in NTP, the worst of which could lead to remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8_p11 | >= 4.2.8_p11 |
NTP contains software for the Network Time Protocol.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code or cause a Denial of Service condition.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p11"
Multiple vulnerabilities have been found in NTP, the worst of which could lead to Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8_p8 | >= 4.2.8_p8 |
NTP contains software for the Network Time Protocol.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly cause a Denial of Service condition.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p8"
Multiple vulnerabilities have been found in NTP, the worst of which could lead to arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8_p3 | >= 4.2.8_p3 |
NTP contains software for the Network Time Protocol.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process, or cause a Denial of Service condition.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8_p3"
Multiple vulnerabilities have been found in NTP, the worst of which could result in remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.8 | >= 4.2.8 |
NTP is a protocol designed to synchronize the clocks of computers over a network. The net-misc/ntp package contains the official reference implementation by the NTP Project.
Multiple vulnerabilities have been discovered in NTP. Please review the CVE identifiers referenced below for details.
A remote unauthenticated attacker may be able to execute arbitrary code with the privileges of the process, cause a Denial of Service condition, and obtain sensitive information that could assist in other attacks.
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.8"
NTP can be abused to amplify Denial of Service attack traffic.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.6_p5-r10 | >= 4.2.6_p5-r10 |
NTP is a protocol designed to synchronize the clocks of computers over a network. The net-misc/ntp package contains the official reference implementation by the NTP Project.
ntpd is susceptible to a reflected Denial of Service attack. Please review the CVE identifiers and references below for details.
An unauthenticated remote attacker may conduct a distributed reflective Denial of Service attack on another user via a vulnerable NTP server.
We modified the default ntp configuration in =net-misc/ntp-4.2.6_p5-r10 and added “noquery” to the default restriction which disallows anyone to query the ntpd status, including “monlist”.
If you use a non-default configuration, and provide a ntp service to untrusted networks, we highly recommend you to revise your configuration to disable mode 6 and 7 queries for any untrusted (public) network.
You can always enable these queries for specific trusted networks. For more details please see the “Access Control Support” chapter in the ntp.conf(5) man page.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.6_p5-r10"
Note that the updated package contains a modified default configuration only. You may need to modify your configuration further.
A Denial of Service condition in ntpd can cause excessive CPU or bandwidth consumption.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.4_p7-r1 | >= 4.2.4_p7-r1 |
NTP is a set of the Network Time Protocol programs.
Robin Park and Dmitri Vinokurov discovered that ntp_request.c in ntpd does not handle MODE_PRIVATE packets correctly, causing a continuous exchange of MODE_PRIVATE error responses between two NTP daemons or causing high CPU load on a single host.
A remote, unauthenticated attacker could send a specially crafted MODE_PRIVATE packet, allowing for a Denial of Service condition (CPU and bandwidth consumption).
There is no known workaround at this time.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.4_p7-r1"
Multiple errors in the NTP client and server programs might allow for the remote execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.4_p7 | >= 4.2.4_p7 |
NTP contains the client and daemon implementations for the Network Time Protocol.
Multiple vulnerabilities have been found in the programs included in the NTP package:
A remote attacker might send a specially crafted package to a machine running ntpd, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the daemon, or a Denial of Service. NOTE: Successful exploitation requires the "autokey" feature to be enabled. This feature is only available if NTP was built with the 'ssl' USE flag.
Furthermore, a remote attacker could entice a user into connecting to a malicious server using ntpq, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service.
You can protect against CVE-2009-1252 by disabling the 'ssl' USE flag and recompiling NTP.
All NTP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.4_p7"
An error in the OpenSSL certificate chain validation in ntp might allow for spoofing attacks.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-misc/ntp | * | < 4.2.4_p6 | >= 4.2.4_p6 |
ntp contains the client and daemon implementations for the Network Time Protocol.
It has been reported that ntp incorrectly checks the return value of the EVP_VerifyFinal(), a vulnerability related to CVE-2008-5077 (GLSA 200902-02).
A remote attacker could exploit this vulnerability to spoof arbitrary names to conduct Man-In-The-Middle attacks and intercept sensitive information.
There is no known workaround at this time.
All ntp users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.4_p6"