USN-705-1: NTP vulnerability


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) USN-705-1: NTP vulnerability
# 1  
Old 01-08-2009
USN-705-1: NTP vulnerability

Referenced CVEs:
CVE-2009-0021


Description:
=========================================================== Ubuntu Security Notice USN-705-1 January 08, 2009 ntp vulnerability CVE-2009-0021 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.10 Ubuntu 8.04 LTS Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: ntp-refclock 1:4.2.0a+stable-8.1ubuntu6.1 ntp-simple 1:4.2.0a+stable-8.1ubuntu6.1 Ubuntu 7.10: ntp 1:4.2.4p0+dfsg-1ubuntu2.1 Ubuntu 8.04 LTS: ntp 1:4.2.4p4+dfsg-3ubuntu2.1 Ubuntu 8.10: ntp 1:4.2.4p4+dfsg-6ubuntu2.2 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that NTP did not properly perform signature verification. A remote attacker could exploit this to bypass certificate validation via a malformed SSL/TLS signature.





More...
Login or Register to Ask a Question

Previous Thread | Next Thread

1 More Discussions You Might Find Interesting

1. AIX

NTP Information Disclosure Vulnerability

Hi All, How to reslove above Vulnerability,currently we have AIX6.1 OS running,would you please share with me step-by-step procedure Thanks in advance Thanks Murali Muppa (0 Replies)
Discussion started by: 969murali@gmail
0 Replies
Login or Register to Ask a Question
ntp-wait(1)							   User Commands						       ntp-wait(1)

NAME
ntp-wait - Wait for ntpd to stabilize the system clock SYNOPSIS
ntp-wait [-flags] [-flag [value]] [--option-name[[=| ]value]] All arguments must be options. DESCRIPTION
ntp-wait will send at most num-tries queries to ntpd(8), sleeping for secs-between-tries after each status return that says ntpd(8) has not yet produced a synchronized and stable system clock. ntp-wait will do this quietly, unless the -v flag is provided. This can be useful at boot time, to delay the boot sequence until after ntpd -g has set the time. OPTIONS
-n number, --tries=number Number of times to check ntpd. This option takes an integer number as its argument. The default number for this option is: 100 The maximum number of times we will check ntpd to see if it has been able to synchronize and stabilize the system clock. -s secs-between-tries, --sleep=secs-between-tries How long to sleep between tries. This option takes an integer number as its argument. The default secs-between-tries for this option is: 6 We will sleep for secs-between-tries after each query of ntpd that returns "the time is not yet stable". -v, --verbose Be verbose. By default, ntp-wait is silent. With this option, ntp-wait will provide status information. -?, --help Display usage information and exit. -!, --more-help Pass the extended usage information through a pager. -v [{v|c|n --version [{v|c|n}]}] Output version of program and exit. The default mode is `v', a simple version. The `c' mode will print copyright information and `n' will print the full copyright notice. EXIT STATUS
One of the following exit values will be returned: 0 (EXIT_SUCCESS) Successful program execution. 1 (EXIT_FAILURE) The operation failed or the command syntax was not valid. 70 (EX_SOFTWARE) libopts had an internal operational error. Please report it to autogen-users@lists.sourceforge.net. Thank you. AUTHORS
Harlan Stenn NOTES
This document corresponds to version 4.2.8p13 of NTP. This manual page was AutoGen-erated from the ntp-wait option definitions. ntp (4.2.8p13) 20 Feb 2019 ntp-wait(1)