Debian Ntp vulnerabilities

CVE-2023-26555 [MEDIUM] CVE-2023-26555: ntp - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds w... praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver. Scope: local bullseye: open

CVE-2023-26554 [MEDIUM] CVE-2023-26554: ntp - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when addi... mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Scope: local bullseye: open

CVE-2023-26551 [MEDIUM] CVE-2023-26551: ntp - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp... mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Scope: local bullseye: open

CVE-2023-26553 [MEDIUM] CVE-2023-26553: ntp - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copy... mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Scope: local bullseye: open

CVE-2023-26552 [MEDIUM] CVE-2023-26552: ntp - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when addi... mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd. Scope: local bullseye: open

CVE-2020-11868 [HIGH] CVE-2020-11868: ntp - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker... ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. Scope: local bullseye: resolved (fixed in 1:4.2.8p14+dfsg-1)

CVE-2020-15025 [MEDIUM] CVE-2020-15025: ntp - ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attacke... ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file. Scope: local bullseye: resolved (fixed in 1:4.2.8p15-1)

CVE-2020-13817 [HIGH] CVE-2020-13817: ntp - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to ... ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance. Scope: local bul

CVE-2019-8936 [HIGH] CVE-2019-8936: ntp - NTP through 4.2.8p12 has a NULL Pointer Dereference. NTP through 4.2.8p12 has a NULL Pointer Dereference. Scope: local bullseye: resolved (fixed in 1:4.2.8p12+dfsg-4)

CVE-2018-7182 [HIGH] CVE-2018-7182: ntp - The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote atta... The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10. Scope: local bullseye: resolved (fixed in 1:4.2.8p11+dfsg-1)

CVE-2018-7170 [MEDIUM] CVE-2018-7170: ntp - ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated us... ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549. Scope: local bullseye: resolved (fixed in 1:

CVE-2018-8956 [MEDIUM] CVE-2018-8956: ntp - ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to ... ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's

CVE-2018-7185 [HIGH] CVE-2018-7185: ntp - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to ca... The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the "other side" of an interleaved association causing the victim ntpd to reset its association. Scope: local bullseye: resolved (fixed in 1:4.2.8p11+dfsg-1)

CVE-2018-7183 [CRITICAL] CVE-2018-7183: ntp - Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p1... Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array. Scope: local bullseye: resolved (fixed in 1:4.2.8p11+dfsg-1)

CVE-2018-7184 [HIGH] CVE-2018-7184: ntp - ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "recei... ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the "received" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-201

CVE-2018-12327 [CRITICAL] CVE-2018-12327: ntp - Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an ... Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source. Scope

CVE-2017-6460 [HIGH] CVE-2017-6460: ntp - Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p... Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response. Scope: local bullseye: resolved (fixed in 1:4.2.8p10+dfsg-1)

CVE-2017-6463 [MEDIUM] CVE-2017-6463: ntp - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to... NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option. Scope: local bullseye: resolved (fixed in 1:4.2.8p10+dfsg-1)

CVE-2017-6459 [MEDIUM] CVE-2017-6459: ntp - The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows loc... The Windows installer for NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via vectors related to an argument with multiple null bytes. Scope: local bullseye: resolved

CVE-2017-6455 [HIGH] CVE-2017-6455: ntp - NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local use... NTP before 4.2.8p10 and 4.3.x before 4.3.94, when using PPSAPI, allows local users to gain privileges via a DLL in the PPSAPI_DLLS environment variable. Scope: local bullseye: resolved