Debian Ntp vulnerabilities

CVE-2015-7973 [MEDIUM] CVE-2015-7973: ntp - NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, a... NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network. Scope: local bullseye: resolved (fixed in 1:4.2.8p7+dfsg-1)

CVE-2015-1798 [LOW] CVE-2015-1798: ntp - The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP ... The symmetric-key feature in the receive function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting the MAC. Scope: local bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-6)

CVE-2015-7974 [HIGH] CVE-2015-7974: ntp - NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations o... NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key." Scope: local bullseye: resolved (fixed in 1:4.2.8p7+dfsg-1)

CVE-2015-5219 [HIGH] CVE-2015-5219: ntp - The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform... The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet. Scope: local bullseye: resolved (fixed in 1:4.2.8p3+dfsg-1)

CVE-2015-5194 [HIGH] CVE-2015-5194: ntp - The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 a... The log_config_command function in ntp_parser.y in ntpd in NTP before 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands. Scope: local bullseye: resolved (fixed in 1:4.2.8p3+dfsg-1)

CVE-2015-5195 [HIGH] CVE-2015-5195: ntp - ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause ... ntp_openssl.m4 in ntpd in NTP before 4.2.7p112 allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation. Scope: local bullseye: resolved (fixed in 1:4.2.8p3+dfsg-1)

CVE-2014-9295 [HIGH] CVE-2014-9295: ntp - Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote a... Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. Scope: local bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-3.2)

CVE-2014-9293 [HIGH] CVE-2014-9293: ntp - The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not... The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Scope: local bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-3.2)

CVE-2014-9294 [HIGH] CVE-2014-9294: ntp - util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, wh... util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. Scope: local bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-3.2)

CVE-2014-9296 [MEDIUM] CVE-2014-9296: ntp - The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to exe... The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. Scope: local bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-3.2)

CVE-2014-9751 [MEDIUM] CVE-2014-9751: ntp - The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 o... The read_network_packet function in ntp_io.c in ntpd in NTP 4.x before 4.2.8p1 on Linux and OS X does not properly determine whether a source IP address is an IPv6 loopback address, which makes it easier for remote attackers to spoof restricted packets, and read or write to the runtime state, by leveraging the ability to reach the ntpd machine's network interface with a

CVE-2014-9750 [MEDIUM] CVE-2014-9750: ntp - ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is e... ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field. Scope: local bullseye: resolved (fixed in 1:4.2.6.p5+dfsg-5)

CVE-2014-5209 [MEDIUM] CVE-2014-5209: ntp - An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7... An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information. Scope: local bullseye: resolved (fixed in 1:4.2.8p3+dfsg-1)

CVE-2013-5211 [MEDIUM] CVE-2013-5211: ntp - The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remot... The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013. Scope: local bullseye: resolved (fixed in 1:4.2.8p3+dfsg-1)

CVE-2009-1252 [MEDIUM] CVE-2009-1252: ntp - Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd ... Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field. Scope: local bullseye: resolved (fixed in 1:4.2.4p6+dfsg-2)

CVE-2009-3563 [MEDIUM] CVE-2009-3563: ntp - ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers ... ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons. Scope: local bullseye: resolved (fixed in 1:4.2.4p8+dfsg-1)

CVE-2009-0021 [MEDIUM] CVE-2009-0021: ntp - NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the ... NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077. Scope: local bullseye: resolved (fixed in 1:4.2.4p4+dfsg-8)

CVE-2009-0159 [MEDIUM] CVE-2009-0159: ntp - Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq i... Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response. Scope: local bullseye: resolved (fixed in 1:4.2.4p6+dfsg-2)

CVE-2005-2496 [MEDIUM] CVE-2005-2496: ntp - The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using... The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended. Scope: local bullseye: resolved (fixed in 1:4.2.0a+stable-2sarge1)

CVE-2004-0657 [MEDIUM] CVE-2004-0657: ntp - Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to re... Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more than 34 years away from the server's time. Scope: local bullseye: resolved (fixed in 4.0)