Changes between Initial Version and Version 1 of Ticket #5971


Ignore:
Timestamp:
12/22/2014 01:36:23 PM (9 years ago)
Author:
Fernando de Oliveira
Comment:

Legend:

Unmodified
Added
Removed
Modified

  • Ticket #5971

    • Property Priority normal → high
    • Property Severity normal → major

  • Ticket #5971 – Description

    initial v1  
    11[http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8.tar.gz]
     2
     3[http://lists.ntp.org/pipermail/announce/2014-December/000122.html]
     4
     5Summary of the announcement:
     6
     7{{{
     8Harlan Stenn stenn at ntp.org
     9Mon Dec 22 00:42:24 UTC 2014
     10
     11...
     12
     13NTP 4.2.8 (Harlan Stenn <stenn at ntp.org>, 2014/12/18)
     14 
     15Focus: Security and Bug fixes, enhancements.
     16 
     17Severity: HIGH
     18 
     19In addition to bug fixes and enhancements, this release fixes the
     20following high-severity vulnerabilities:
     21
     22************************** vv NOTE WELL vv *****************************
     23
     24The vulnerabilities listed below can be significantly mitigated by
     25following the BCP of putting
     26
     27 restrict default ... noquery
     28
     29in the ntp.conf file.  With the exception of:
     30
     31   receive(): missing return on error
     32   References: Sec 2670 / CVE-2014-9296 / VU#852879
     33
     34below (which is a limited-risk vulnerability), none of the recent
     35vulnerabilities listed below can be exploited if the source IP is
     36restricted from sending a 'query'-class packet by your ntp.conf file.
     37
     38************************** ^^ NOTE WELL ^^ *****************************
     39
     40* Weak default key in config_auth().
     41...
     42* Non-cryptographic random number generator with weak seed used by
     43  ntp-keygen to generate symmetric keys.
     44...
     45* Buffer overflow in crypto_recv()
     46...
     47* Buffer overflow in ctl_putdata()
     48...
     49* Buffer overflow in configure()
     50...
     51* receive(): missing return on error
     52...
     53
     54See http://support.ntp.org/security for more information.
     55
     56New features / changes in this release:
     57
     58Important Changes
     59
     60* Internal NTP Era counters
     61...
     62* ntpdc responses disabled by default
     63...
     64}}}