ID de Prueba:	1.3.6.1.4.1.25623.1.0.871756
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for ntp RHSA-2017:0252-01
Resumen:	The remote host is missing an update for the 'ntp'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'ntp' package(s) announced via the referenced advisory. Vulnerability Insight: The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix(es): * It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) * A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) * A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) * A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) * A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433) Affected Software/OS: ntp on Red Hat Enterprise Linux Desktop (v. 6), Red Hat Enterprise Linux Server (v. 6), Red Hat Enterprise Linux Server (v. 7), Red Hat Enterprise Linux Workstation (v. 6) Solution: Please Install the Updated Packages. CVSS Score: 7.1 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7426 BugTraq ID: 94451 http://www.securityfocus.com/bid/94451 CERT/CC vulnerability note: VU#633847 https://www.kb.cert.org/vuls/id/633847 FreeBSD Security Advisory: FreeBSD-SA-16:39 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc RedHat Security Advisories: RHSA-2017:0252 http://rhn.redhat.com/errata/RHSA-2017-0252.html http://www.securitytracker.com/id/1037354 https://usn.ubuntu.com/3707-2/ Common Vulnerability Exposure (CVE) ID: CVE-2016-7429 BugTraq ID: 94453 http://www.securityfocus.com/bid/94453 Common Vulnerability Exposure (CVE) ID: CVE-2016-7433 BugTraq ID: 94455 http://www.securityfocus.com/bid/94455 Bugtraq: 20161222 FreeBSD Security Advisory FreeBSD-SA-16:39.ntp (Google Search) http://www.securityfocus.com/archive/1/539955/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/539955/100/0/threaded Bugtraq: 20170310 [security bulletin] HPESBUX03706 rev.1 - HP-UX NTP service running ntpd, Multiple Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/540254/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/540254/100/0/threaded https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5E3XBBCK5IXOLDAH2E4M3QKIYIHUMMP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ILMSYVQMMF37MANYEO7KBHOPSC74EKGN/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PABKEYX6ABBFJZGMXKH57X756EJUDS3C/ https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 SuSE Security Announcement: openSUSE-SU-2016:3280 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html http://www.ubuntu.com/usn/USN-3349-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-9310 BugTraq ID: 94452 http://www.securityfocus.com/bid/94452 Common Vulnerability Exposure (CVE) ID: CVE-2016-9311 BugTraq ID: 94444 http://www.securityfocus.com/bid/94444
Copyright	Copyright (C) 2017 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.