Organizacja Network Time Foundation’s publikuję nową wersję protokołu ntp

utworzone przez | mar 23, 2017 | Aktualizacje | 0 komentarzy

W dniu 21 marca, organizacja Network Time Foundation’s opublikowała nową wersje protokołu  ntp-4.2.8p10 który naprawia wiele podatności, m.in.:

 

  • Sec 3389 / CVE-2017-6464 / VU#325339: NTP-01-016 NTP: Denial of Service via Malformed Config (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3388 / CVE-2017-6462 / VU#325339: NTP-01-014 NTP: Buffer Overflow in DPTS Clock (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3387 / CVE-2017-6463 / VU#325339: NTP-01-012 NTP: Authenticated DoS via Malicious Config Option (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3386: NTP-01-011 NTP: ntpq_stripquotes() returns incorrect Value (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3385: NTP-01-010 NTP: ereallocarray()/eallocarray() underused (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3384 / CVE-2017-6455 / VU#325339: NTP-01-009 NTP: Windows: Privileged execution of User Library code (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3383 / CVE-2017-6452 / VU#325339: NTP-01-008 NTP: Windows Installer: Stack Buffer Overflow from Command Line (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3382 / CVE-2017-6459 / VU#325339: NTP-01-007 NTP: Windows Installer: Data Structure terminated insufficiently (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3381: NTP-01-006 NTP: Copious amounts of Unused Code (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3380: NTP-01-005 NTP: Off-by-one in Oncore GPS Receiver (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3379 / CVE-2017-6458 / VU#325339: NTP-01-004 NTP: Potential Overflows in ctl_put() functions (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3378 / CVE-2017-6451 / VU#325339: NTP-01-003 Improper use of snprintf() in mx4200_send() (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3377 / CVE-2017-6460 / VU#325339: NTP-01-002 Buffer Overflow in ntpq when fetching reslist (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3376: NTP-01-001 Makefile does not enforce Security Flags (Pentest report 01.2017)
    • Reported by Cure53.
  • Sec 3361 / CVE-2016-9042 / VU#325339: 0rigin
    • Reported by Matthew Van Gundy of Cisco ASIG

 

 

CERT PSE zachęca administratorów  do pobrania i zastosowania nowej wersji protokołu ntp-4.2.8p10