Oracle Solaris Third-Party Patch Update : ntp (multiple_vulnerabilities_in_ntp)
High Nessus Plugin ID 80934
SynopsisThe remote Solaris system is missing a security patch for third-party software.
DescriptionThe remote Solaris system is missing necessary patches to address security updates :
- Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function. (CVE-2014-9295)
- The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets. (CVE-2014-9296)
SolutionUpgrade to Solaris 220.127.116.11.0.