This script is Copyright (C) 2015 Tenable Network Security, Inc.
The remote SuSE 11 host is missing one or more security updates.
ntp has been updated to fix four security issues :
- ntp-keygen used a weak RNG seed, which made it easier
for remote attackers to defeat cryptographic protection
mechanisms via a brute-force attack. (bsc#910764).
- The config_auth function, when an auth key is not
configured, improperly generated a key, which made it
easier for remote attackers to defeat cryptographic
protection mechanisms via a brute-force attack.
- ::1 can be spoofed on some operating systems, so ACLs
based on IPv6 ::1 addresses could be bypassed.
- vallen is not validated in several places in
ntp_crypto.c, leading to potential information leak.
See also :
Apply SAT patch number 10293.
Risk factor :
High / CVSS Base Score : 7.5