First published: Mon May 18 2009(Updated: )
The Network Time Protocol (NTP) is used to synchronize a computer's time<br>with a referenced time source.<br>A buffer overflow flaw was discovered in the ntpd daemon's NTPv4<br>authentication code. If ntpd was configured to use public key cryptography<br>for NTP packet authentication, a remote attacker could use this flaw to<br>send a specially-crafted request packet that could crash ntpd or,<br>potentially, execute arbitrary code with the privileges of the "ntp" user.<br>(CVE-2009-1252)<br>Note: NTP authentication is not enabled by default.<br>A buffer overflow flaw was found in the ntpq diagnostic command. A<br>malicious, remote server could send a specially-crafted reply to an ntpq<br>request that could crash ntpq or, potentially, execute arbitrary code with<br>the privileges of the user running the ntpq command. (CVE-2009-0159)<br>All ntp users are advised to upgrade to this updated package, which<br>contains backported patches to resolve these issues. After installing the<br>update, the ntpd daemon will be restarted automatically.
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/ntp | <4.2.0.a.20040617-8.el4_7.2 | 4.2.0.a.20040617-8.el4_7.2 |
redhat/ntp | <4.2.0.a.20040617-8.el4_7.2 | 4.2.0.a.20040617-8.el4_7.2 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.