Sponsor of the Day:
Jerkmate
https://www.ntp.org/support/securitynotice/ntpbug3415/
NTP BUG 3415: Provide a way to prevent authenticated symmetric passive peering
A malicious authenticated peer – one where the attacker knows the private symmetric key – can create arbitrarily-many ephemeral associations in order to win...
ntp bug3415providewayprevent
https://www.ntp.org/support/securitynotice/ntpbug2918/
NTP BUG 2918: Potential path traversal vulnerability in the config file saving of ntpd on VMS
If ntpd is configured to allow remote configuration, and the IP address is allowed to send remote configuration requests, and the attacker knows the remote...
path traversal vulnerabilityntp bugconfig file2918potential
https://www.ntp.org/support/securitynotice/ntpbug3118/
NTP BUG 3118: Mode 6 unauthenticated trap information disclosure and DDoS vector
An exploitable configuration modification vulnerability exists in the control mode functionality of ntpd. If, against long-standing BCP recommendations,...
ntp buginformation disclosure3118mode6
https://www.ntp.org/support/securitynotice/ntpbug2956/
NTP BUG 2956: Small-step/big-step
There is a window of opportunity where an attacker can cause ntpd to set the time to an arbitrary value. This bug was resolved in NTP 4.2.8p5.
ntp bugsmall step2956big
https://www.ntp.org/documentation/4.2.8-series/bugs/
NTP Bug Reporting Procedures
Instructions for reporting a security-related bug to the NTP security officer and reporting a non-security bug to the NTP bug tracker.
ntp bugreporting procedures
https://www.ntp.org/support/securitynotice/ntpbug2978/
NTP BUG 2978: Interleave-pivot
It is possible to change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved...
ntp bug2978interleavepivot
https://www.ntp.org/support/securitynotice/ntpbug2922/
NTP BUG 2922: decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values
If ntpd is fed a crafted mode 6 or mode 7 packet containing an unusually long data value where a network address is expected, the decodenetnum() function will...
ntp bug2922assertbotchinstead
https://www.ntp.org/support/securitynotice/ntpbug2938/
NTP BUG 2938: ntpq saveconfig command allows dangerous characters in filenames
The ntpq saveconfig command does not do adequate filtering of special characters from the supplied filename. This bug was resolved in NTP 4.2.8p6.
ntp bug2938commandallowsdangerous
https://www.ntp.org/support/securitynotice/ntpbug3011/
NTP BUG 3011: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd
If ntpd was configured to allow for remote configuration, a malicious user who knows the controlkey for ntpq or the requestkey for ntpdc can create a session...
ntp bug3011duplicateipsdirectives
https://www.ntp.org/support/securitynotice/ntpbug2853/
NTP BUG 2853: ntpd control message crash: Crafted NUL-byte in configuration directive
Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This bug was resolved in NTP...
ntp bugcontrol message2853ntpdcrash