Описание
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message.
Меры по смягчению последствий
Properly monitor your ntpd instances, and auto-restart ntpd (without -g) if it stops running.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 5 | ntp | Will not fix | ||
| Red Hat Enterprise Linux 6 | ntp | Fixed | RHSA-2017:3071 | 26.10.2017 |
| Red Hat Enterprise Linux 7 | ntp | Fixed | RHSA-2018:0855 | 10.04.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticate ...
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
Уязвимость опции unpeer реализации протокола синхронизации времени NTP, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
6.5 Medium
CVSS3