Package "ntp-doc"
Name: |
ntp-doc
|
Description: |
Network Time Protocol documentation
|
Latest version: |
1:4.2.6.p3+dfsg-1ubuntu3.13 |
Release: |
precise (12.04) |
Level: |
updates |
Repository: |
main |
Head package: |
ntp |
Homepage: |
http://support.ntp.org/ |
Links
Download "ntp-doc"
Other versions of "ntp-doc" in Precise
Changelog
ntp (1:4.2.6.p3+dfsg-1ubuntu3.13) precise-security; urgency=medium
* SECURITY UPDATE: crash or possible code execution via a long string as
the ipv4 host argument
- debian/patches/CVE-2018-12327.patch prevent overflow of host
in openhost() in ntpq/ntpq.c and ntpdc/ntpdc.c.
- CVE-2018-12327
-- Mark Morlino <email address hidden> Mon, 06 Jan 2020 09:38:04 -0500
|
Source diff to previous version |
CVE-2018-12327 |
Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges v |
|
ntp (1:4.2.6.p3+dfsg-1ubuntu3.11) precise-security; urgency=medium
* SECURITY UPDATE: Deja Vu replay attack on authenticated broadcast mode
- debian/patches/CVE-2015-7973.patch: improve timestamp verification in
include/ntp.h, ntpd/ntp_proto.c.
- CVE-2015-7973
* SECURITY UPDATE: impersonation between authenticated peers
- debian/patches/CVE-2015-7974.patch: check key ID in ntpd/ntp_proto.c.
- CVE-2015-7974
* SECURITY UPDATE: ntpq saveconfig command allows dangerous characters in
filenames
- debian/patches/CVE-2015-7976.patch: check filename in
ntpd/ntp_control.c.
- CVE-2015-7976
* SECURITY UPDATE: restrict list denial of service
- debian/patches/CVE-2015-7977-7978.patch: improve restrict list
processing in ntpd/ntp_request.c.
- CVE-2015-7977
- CVE-2015-7978
* SECURITY UPDATE: authenticated broadcast mode off-path denial of
service
- debian/patches/CVE-2015-7979.patch: add more checks to
ntpd/ntp_proto.c.
- CVE-2015-7979
- CVE-2016-1547
* SECURITY UPDATE: Zero Origin Timestamp Bypass
- debian/patches/CVE-2015-8138.patch: check p_org in ntpd/ntp_proto.c.
- CVE-2015-8138
* SECURITY UPDATE: potential infinite loop in ntpq
- debian/patches/CVE-2015-8158.patch: add time checks to ntpdc/ntpdc.c,
ntpq/ntpq.c.
- CVE-2015-8158
* SECURITY UPDATE: NTP statsdir cleanup cronjob insecure (LP: #1528050)
- debian/ntp.cron.daily: fix security issues, patch thanks to halfdog!
- CVE-2016-0727
* SECURITY UPDATE: time spoofing via interleaved symmetric mode
- debian/patches/CVE-2016-1548.patch: check for bogus packets in
ntpd/ntp_proto.c.
- CVE-2016-1548
* SECURITY UPDATE: buffer comparison timing attacks
- debian/patches/CVE-2016-1550.patch: use CRYPTO_memcmp in
libntp/a_md5encrypt.c, sntp/crypto.c.
- CVE-2016-1550
* SECURITY UPDATE: DoS via duplicate IPs on unconfig directives
- debian/patches/CVE-2016-2516.patch: improve logic in
ntpd/ntp_request.c.
- CVE-2016-2516
* SECURITY UPDATE: denial of service via crafted addpeer
- debian/patches/CVE-2016-2518.patch: check mode value in
ntpd/ntp_request.c.
- CVE-2016-2518
* SECURITY UPDATE: denial of service via spoofed packets
- debian/patches/CVE-2016-4954.patch: discard packet that fails tests
in ntpd/ntp_proto.c.
- CVE-2016-4954
* SECURITY UPDATE: denial of service via spoofed crypto-NAK or incorrect
MAC
- debian/patches/CVE-2016-4955.patch: fix checks in ntpd/ntp_proto.c.
- CVE-2016-4955
* SECURITY UPDATE: denial of service via spoofed broadcast packet
- debian/patches/CVE-2016-4956.patch: properly handle switch in
broadcast interleaved mode in ntpd/ntp_proto.c.
- CVE-2016-4956
-- Marc Deslauriers <email address hidden> Wed, 05 Oct 2016 08:19:03 -0400
|
Source diff to previous version |
1528050 |
NTP statsdir cleanup cronjob insecure |
CVE-2015-7973 |
Deja Vu: Replay attack on authenticated broadcast mode |
CVE-2015-7974 |
NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remot |
CVE-2015-7976 |
ntpq saveconfig command allows dangerous characters in filenames |
CVE-2015-7977 |
reslist NULL pointer dereference |
CVE-2015-7978 |
Stack exhaustion in recursive traversal of restriction list |
CVE-2015-7979 |
Off-path Denial of Service (DoS) attack on authenticated broadcast mode |
CVE-2016-1547 |
Validate crypto-NAKs |
CVE-2015-8138 |
ntp: missing check for zero originate timestamp |
CVE-2015-8158 |
Potential Infinite Loop in ntpq |
CVE-2016-0727 |
NTP statsdir cleanup cronjob insecure |
CVE-2016-1548 |
Change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mo |
CVE-2016-1550 |
Timing attack for authenticated packets |
CVE-2016-2516 |
Duplicate IPs on unconfig directives will cause an assertion failure |
CVE-2016-2518 |
Crafted addpeer with hmode > 7 causes out-of-bounds reference |
CVE-2016-4954 |
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modi |
CVE-2016-4955 |
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association |
CVE-2016-4956 |
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broad |
|
ntp (1:4.2.6.p3+dfsg-1ubuntu3.9) precise; urgency=medium
* ntpd rejects source UDP ports less than 123 as bogus (closes: #691412)
- d/p/reject-UDP-ports-less-than-123-as-bogus.patch (LP: #1479652)
-- Eric Desrochers <email address hidden> Mon, 25 Jan 2016 12:28:25 -0500
|
Source diff to previous version |
1479652 |
[patch] ntpd rejects source UDP ports less than 123 as bogus |
691412 |
ntpd rejects source UDP ports less than 123 as bogus. - Debian Bug report logs |
|
ntp (1:4.2.6.p3+dfsg-1ubuntu3.8) precise; urgency=medium
* Use a single lockfile again - instead unlock the file before starting the
init script. The lock sho uld be shared - both services can't run at the
same time. (LP: #1125726)
-- Cam Cope <email address hidden> Tue, 19 Jan 2016 10:20:07 +0000
|
Source diff to previous version |
1125726 |
boot-time race between /etc/network/if-up.d/ntpdate and \ |
|
ntp (1:4.2.6.p3+dfsg-1ubuntu3.7) precise; urgency=medium
* Fix use-after-free in routing socket code (closes: #795315)
- debian/patches/use-after-free-in-routing-socket.patch:
fix logic in ntpd/ntp_io.c (LP: #1481388)
-- Eric Desrochers Thu, 29 Oct 2015 09:47:20 -0400
|
1481388 |
NTP : Use-after-free in routing socket code after dropping root |
795315 |
/usr/sbin/ntpd: ntpd segfaults in input_handler at ntp_io.c:3642 - Debian Bug report logs |
|
About
-
Send Feedback to @ubuntu_updates