According to the versions of the ntp packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was discovered in the NTP server's     parsing of configuration directives. A remote,     authenticated attacker could cause ntpd to crash by     sending a crafted message.(CVE-2017-6463)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is     enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage)     by sending (1) a spoofed crypto-NAK packet or (2) a     packet with an incorrect MAC value at a certain     time.(CVE-2016-4955)

  - The ntpq and ntpdc command-line utilities that are part     of ntp package are vulnerable to stack-based buffer     overflow via crafted hostname. Applications using these     vulnerable utilities with an untrusted input may be     potentially exploited, resulting in a crash or     arbitrary code execution under privileges of that     application.(CVE-2018-12327)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7     is enabled, allows remote attackers to cause a denial     of service (ntpd abort) by using the same IP address     multiple times in an unconfig directive.(CVE-2016-2516)

  - A flaw was found in the way NTP verified trusted keys     during symmetric key authentication. An authenticated     client (A) could use this flaw to modify a packet sent     between a server (B) and a client (C) using a key that     is different from the one known to the client     (A).(CVE-2015-7974)

  - A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If     ntpd was configured to use autokey authentication, an     attacker could send packets to ntpd that would, after     several days of ongoing attack, cause it to run out of     memory.(CVE-2015-7701)

  - An out-of-bounds access flaw was found in the way ntpd     processed certain packets. An authenticated attacker     could use a crafted packet to create a peer association     with hmode of 7 and larger, which could potentially     (although highly unlikely) cause ntpd to     crash.(CVE-2016-2518)

  - A stack-based buffer overflow was found in the way the     NTP autokey protocol was implemented. When an NTP     client decrypted a secret received from an NTP server,     it could cause that client to crash.(CVE-2014-9750)

  - It was found that NTP's :config command could be used     to set the pidfile and driftfile paths without any     restrictions. A remote attacker could use this flaw to     overwrite a file on the file system with a file     containing the pid of the ntpd process (immediately) or     the current estimated drift of the system clock (in     hourly intervals).(CVE-2015-7703)

  - A flaw was found in the way ntpd running on a host with     multiple network interfaces handled certain server     responses. A remote attacker could use this flaw which     would cause ntpd to not synchronize with the     source.(CVE-2016-7429)

  - A flaw was found in the way ntpd implemented the trap     service. A remote attacker could send a specially     crafted packet to cause a null pointer dereference that     will crash ntpd, resulting in a denial of     service.(CVE-2016-9311)

  - It was found that ntp-keygen used a weak method for     generating MD5 keys. This could possibly allow an     attacker to guess generated MD5 keys that could then be     used to spoof an NTP client or server. Note: it is     recommended to regenerate any MD5 keys that had     explicitly been generated with ntp-keygen the default     installation does not contain such keys.(CVE-2014-9294)

  - It was found that when NTP was configured in broadcast     mode, a remote attacker could broadcast packets with     bad authentication to all clients. The clients, upon     receiving the malformed packets, would break the     association with the broadcast server, causing them to     become out of sync over a longer period of     time.(CVE-2015-7979)

  - A flaw was found in the way ntpd calculated the root     delay. A remote attacker could send a specially-crafted     spoofed packet to cause denial of service or in some     special cases even crash.(CVE-2016-7433)

  - It was found that the fix for CVE-2014-9750 was     incomplete: three issues were found in the value length     checks in NTP's ntp_crypto.c, where a packet with     particular autokey operations that contained malicious     data was not always being completely validated. A     remote attacker could use a specially crafted NTP     packet to crash ntpd.(CVE-2015-7691)

  - It was found that ntpd did not correctly implement the     threshold limitation for the '-g' option, which is used     to set the time without any restrictions. A     man-in-the-middle attacker able to intercept NTP     traffic between a connecting client and an NTP server     could use this flaw to force that client to make     multiple steps larger than the panic threshold,     effectively changing the time to an arbitrary value at     any time.(CVE-2015-5300)

  - It was found that ntpd would exit with a segmentation     fault when a statistics type that was not enabled     during compilation (e.g. timingstats) was referenced by     the statistics or filegen configuration     command.(CVE-2015-5195)

  - An off-by-one flaw, leading to a buffer overflow, was     found in cookedprint functionality of ntpq. A specially     crafted NTP packet could potentially cause ntpq to     crash.(CVE-2015-7852)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers     to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast     packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548.(CVE-2016-4956)

  - A stack-based buffer overflow flaw was found in the way     ntpd processed 'ntpdc reslist' commands that queried     restriction lists with a large amount of entries. A     remote attacker could use this flaw to crash     ntpd.(CVE-2015-7978)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Detections

Analytics

EulerOS Virtualization 3.0.1.0 : ntp (EulerOS-SA-2019-1556)

critical Nessus Plugin ID 125009

No changelogs found