ID de Prueba:	1.3.6.1.4.1.25623.1.1.10.2016.0219
Categoría:	Mageia Linux Local Security Checks
Título:	Mageia: Security Advisory (MGASA-2016-0219)
Resumen:	The remote host is missing an update for the 'ntp' package(s) announced via the MGASA-2016-0219 advisory.
Descripción:	Summary: The remote host is missing an update for the 'ntp' package(s) announced via the MGASA-2016-0219 advisory. Vulnerability Insight: ntpq and ntpdc disclose the origin timestamp to unauthenticated clients, which may allow an attacker to impersonate a legitimate peer (CVE-2015-8139). An attacker who is able to spoof packets with correct origin timestamps from enough servers before the expected response packets arrive at the target machine can affect some peer variables and, for example, cause a false leap indication to be set (CVE-2016-4954). An attacker who is able to spoof a packet with a correct origin timestamp before the expected response packet arrives at the target machine can send a CRYPTO_NAK or a bad MAC and cause the association's peer variables to be cleared. If this can be done often enough, it will prevent that association from working (CVE-2016-4955). The fix for CVE-2016-1548 does not cover broadcast associations, so broadcast clients can be triggered to flip into interleave mode (CVE-2016-4956). Affected Software/OS: 'ntp' package(s) on Mageia 5. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2015-8139 BugTraq ID: 82105 http://www.securityfocus.com/bid/82105 CERT/CC vulnerability note: VU#718152 https://www.kb.cert.org/vuls/id/718152 Cisco Security Advisory: 20160120 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products - January 2016 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/ FreeBSD Security Advisory: FreeBSD-SA-16:24 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc https://security.gentoo.org/glsa/201607-15 http://www.securitytracker.com/id/1034782 SuSE Security Announcement: SUSE-SU-2016:1175 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html SuSE Security Announcement: SUSE-SU-2016:1177 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html SuSE Security Announcement: SUSE-SU-2016:1247 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html SuSE Security Announcement: SUSE-SU-2016:1311 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html SuSE Security Announcement: openSUSE-SU-2016:1292 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html SuSE Security Announcement: openSUSE-SU-2016:1423 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html Common Vulnerability Exposure (CVE) ID: CVE-2016-4954 Bugtraq: 20160604 FreeBSD Security Advisory FreeBSD-SA-16:24.ntp (Google Search) http://www.securityfocus.com/archive/1/538600/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/538600/100/0/threaded Bugtraq: 20160604 [slackware-security] ntp (SSA:2016-155-01) (Google Search) http://www.securityfocus.com/archive/1/538599/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/538599/100/0/threaded Bugtraq: 20170607 [security bulletin] HPESBHF03757 rev.1 - HPE Network Products including Comware 5 and Comware 7 running NTP, Remote Denial of Service (DoS) (Google Search) http://www.securityfocus.com/archive/1/540683/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/540683/100/0/threaded CERT/CC vulnerability note: VU#321640 http://www.kb.cert.org/vuls/id/321640 https://www.kb.cert.org/vuls/id/321640 Cisco Security Advisory: 20160603 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: June 2016 http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160603-ntpd https://security.FreeBSD.org/advisories/FreeBSD-SA-16:24.ntp.asc http://packetstormsecurity.com/files/137321/Slackware-Security-Advisory-ntp-Updates.html http://packetstormsecurity.com/files/137322/FreeBSD-Security-Advisory-FreeBSD-SA-16-24.ntp.html https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 http://www.securitytracker.com/id/1036037 SuSE Security Announcement: SUSE-SU-2016:1563 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00018.html SuSE Security Announcement: SUSE-SU-2016:1568 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00020.html SuSE Security Announcement: SUSE-SU-2016:1584 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00024.html SuSE Security Announcement: SUSE-SU-2016:1602 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00028.html SuSE Security Announcement: SUSE-SU-2016:1912 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html SuSE Security Announcement: SUSE-SU-2016:2094 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html SuSE Security Announcement: openSUSE-SU-2016:1583 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html SuSE Security Announcement: openSUSE-SU-2016:1636 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00040.html http://www.ubuntu.com/usn/USN-3096-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-4955 BugTraq ID: 91007 http://www.securityfocus.com/bid/91007 Common Vulnerability Exposure (CVE) ID: CVE-2016-4956 BugTraq ID: 91009 http://www.securityfocus.com/bid/91009
Copyright	Copyright (C) 2022 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.