OConnorStP
Level 1
(0 points)
Q: NTP vulnerability on versions prior to 4.2.8 -- we OK?
Just saw this post about an unpatched vulnerability in NTP and wasn't sure what version a Mavericks server would be running. Here's the link:
http://www.zdnet.com/article/major-ntp-security-holes-appears-and-are-being-expl oited/
There are lots of resource links within the post, but I got stuck on the basics -- trying to figure out what version of NTP is running on my server. Can anybody point me in the right direction? From what I can gather, the version of NTP on an Apple server may be different than the vulnerable one, but it's hard to tell.
DPr0f
Level 1
(10 points)
Linc Davis wrote:
That issue pertains to NTP servers, not NTP clients.
At best an oversimplification.
Client and server run exactly the same program — ntpd — and differ only in how they are configured. The server accepts both control and time packets; the client is configured to reject control packets
The most serious of the vulnerabilities in the Advisory is a buffer-overflow triggered by a single cleverly-constructed packet. The Advisory doesn't say whether it is a time packet or a control packet that triggers the buffer-overflow. If the former, then both client and server configurations are vulnerable. If the latter, then it depends on whether the overflow occurs before or after the code which rejects control packets.
We don't know, and it is irresponsible to suggest otherwise.
A remote buffer overflow in a dæmon that runs as root is something to treat seriously until we know that the client configuration is, in fact, not vulnerable.
