The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Using port 123 for modes where a fixed port number is not required facilitates off-path attacks.
    (CVE-2019-11331)

  - A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the     clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec     3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a     victim's clock. (CVE-2016-1549)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a     denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.
    (CVE-2016-2516)

  - The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to     cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP     addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
    (CVE-2016-4954)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2)     a packet with an incorrect MAC value at a certain time. (CVE-2016-4955)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548. (CVE-2016-4956)

  - ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private     symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of     ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for     CVE-2016-1549. (CVE-2018-7170)

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the     other side of an interleaved association causing the victim ntpd to reset its association.
    (CVE-2018-7185)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated     synchronization via a server mode packet with a spoofed source IP address, because transmissions are     rescheduled even when a packet lacks a valid origin timestamp. (CVE-2020-11868)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service     (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The     victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can     query time from the victim's ntpd instance. (CVE-2020-13817)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26551)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26552)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
    An adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26553)

  - mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An     adversary may be able to attack a client ntpq process, but cannot attack ntpd. (CVE-2023-26554)

  - praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method     would be complex, e.g., with a manipulated GPS receiver. (CVE-2023-26555)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Using port 123 for modes where a fixed port number is not required facilitates off-path attacks.
    (CVE-2019-11331)

  - A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the     clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec     3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a     victim's clock. (CVE-2016-1549)

  - NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a     denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.
    (CVE-2016-2516)

  - The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to     cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP     addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
    (CVE-2016-4954)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2)     a packet with an incorrect MAC value at a certain time. (CVE-2016-4955)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548. (CVE-2016-4956)

  - ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private     symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of     ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for     CVE-2016-1549. (CVE-2018-7170)

  - The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service     (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the     other side of an interleaved association causing the victim ntpd to reset its association.
    (CVE-2018-7185)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K09940637 advisory.

  - Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port     number is not required, which makes it easier for remote attackers to conduct off-path attacks.
    (CVE-2019-11331)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - ntp: Stack-based buffer overflow in ntpq and ntpdc allows denial of service or code execution     (CVE-2018-12327)

  - An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and     earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim     client with a spoofed source address of an existing associated peer. This is true even if authentication     is enabled. (CVE-2016-1547)

  - A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the     clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec     3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a     victim's clock. (CVE-2016-1549)

  - An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4     and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to     attempt to recover the message digest key. (CVE-2016-1550)

  - The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to     cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP     addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
    (CVE-2016-4954)

  - ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of     service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2)     a packet with an incorrect MAC value at a certain time. (CVE-2016-4955)

  - ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode     transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an     incomplete fix for CVE-2016-1548. (CVE-2016-4956)

  - NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all     associations is enabled, which allows remote attackers to cause a denial of service (prevent responses     from the sources) by sending responses with a spoofed source address. (CVE-2016-7426)

  - NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source,     which allows remote attackers to cause a denial of service (prevent communication with a source) by     sending a response for a source to an interface the source does not use. (CVE-2016-7429)

  - The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or     unset traps via a crafted control mode packet. (CVE-2016-9310)

  - ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of     service (NULL pointer dereference and crash) via a crafted packet. (CVE-2016-9311)

  - Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10     and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
    (CVE-2017-6462)

  - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service     (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
    (CVE-2017-6463)

  - NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd     crash) via a malformed mode configuration directive. (CVE-2017-6464)

  - ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private     symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of     ntpd and modify a victim's clock via a Sybil attack. This issue exists because of an incomplete fix for     CVE-2016-1549. (CVE-2018-7170)

  - Network Time Protocol (NTP), as specified in RFC 5905, uses port 123 even for modes where a fixed port     number is not required, which makes it easier for remote attackers to conduct off-path attacks.
    (CVE-2019-11331)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated     synchronization via a server mode packet with a spoofed source IP address, because transmissions are     rescheduled even when a packet lacks a valid origin timestamp. (CVE-2020-11868)

  - ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service     (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The     victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can     query time from the victim's ntpd instance. (CVE-2020-13817)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
196526	RHEL 6 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
196630	RHEL 7 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high
184226	F5 Networks BIG-IP : NTP vulnerability (K09940637)	Nessus	F5 Networks Local Security Checks	11/2/2023	5/7/2024	high
196527	RHEL 5 : ntp (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	critical

Detections

Analytics

Plugins Search

high

high

high

critical