Test ID:	1.3.6.1.4.1.25623.1.0.882653
Category:	CentOS Local Security Checks
Title:	CentOS Update for ntp CESA-2017:0252 centos7
Summary:	Check the version of ntp
Description:	Summary: Check the version of ntp Vulnerability Insight: The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service. Security Fix(es): * It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426) * A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310) * A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311) * A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429) * A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433) Affected Software/OS: ntp on CentOS 7 Solution: Please Install the Updated Packages. CVSS Score: 7.1 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-7426 BugTraq ID: 94451 http://www.securityfocus.com/bid/94451 CERT/CC vulnerability note: VU#633847 https://www.kb.cert.org/vuls/id/633847 FreeBSD Security Advisory: FreeBSD-SA-16:39 https://security.FreeBSD.org/advisories/FreeBSD-SA-16:39.ntp.asc RedHat Security Advisories: RHSA-2017:0252 http://rhn.redhat.com/errata/RHSA-2017-0252.html http://www.securitytracker.com/id/1037354 https://usn.ubuntu.com/3707-2/ Common Vulnerability Exposure (CVE) ID: CVE-2016-7429 BugTraq ID: 94453 http://www.securityfocus.com/bid/94453 Common Vulnerability Exposure (CVE) ID: CVE-2016-7433 BugTraq ID: 94455 http://www.securityfocus.com/bid/94455 Bugtraq: 20161222 FreeBSD Security Advisory FreeBSD-SA-16:39.ntp (Google Search) http://www.securityfocus.com/archive/1/539955/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/539955/100/0/threaded Bugtraq: 20170310 [security bulletin] HPESBUX03706 rev.1 - HP-UX NTP service running ntpd, Multiple Vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/540254/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/540254/100/0/threaded https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U5E3XBBCK5IXOLDAH2E4M3QKIYIHUMMP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ILMSYVQMMF37MANYEO7KBHOPSC74EKGN/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PABKEYX6ABBFJZGMXKH57X756EJUDS3C/ https://us-cert.cisa.gov/ics/advisories/icsa-21-159-11 SuSE Security Announcement: openSUSE-SU-2016:3280 (Google Search) http://lists.opensuse.org/opensuse-updates/2016-12/msg00153.html http://www.ubuntu.com/usn/USN-3349-1 Common Vulnerability Exposure (CVE) ID: CVE-2016-9310 BugTraq ID: 94452 http://www.securityfocus.com/bid/94452 Common Vulnerability Exposure (CVE) ID: CVE-2016-9311 BugTraq ID: 94444 http://www.securityfocus.com/bid/94444
Copyright	Copyright (C) 2017 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.