Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Snow Leopard users: Turn off automatic date and time in System Preferences immediately

http://arstechnica.com/apple/2014/12/apple-automatically-patches-macs-to-fix-sev ere-ntp-security-flaw/


When exploited, the NTP flaw can cause buffer overflows that allow remote attackers to execute code on your system.

What this means is that, if you allow date and time to be set automatically by outside servers, you risk having your computer taken over.


This is a critical issue, it's being exploited as we speak, and Apple has not provided the update to Snow Leopard users, only to 10.8/Mountain Lion and above. I strongly doubt Apple will ever get around to issuing an update for Snow Leopard, or they would have already. Chances of that happening are close to zero

Posted on Dec 23, 2014 4:34 PM

Reply
175 replies

Dec 23, 2014 5:12 PM in response to QuickTimeKirk

QuickTimeKirk wrote:


Apple security updates - Apple Support

Older OS's maybe shouldn't be using the Internet.

There is a workaround as mentioned - http://support.ntp.org/bin/view/Main/SecurityNotice#Buffer_overflow_in_ctl_putda ta


Mitigation - any of:

The other option is to build ntp on older systems that Apple may not patch.

Dec 24, 2014 4:49 AM in response to Loner T

The upgrade to 4.2.8 is not quite so simple. You don't just download and install. It's not ready for that: the 4.2.8 needs to be compiled before it can be installed. One way is to use MacPorts + Xcode. As I understand it--and I I haven't done it for my Snow volume (I'm mainly on 10.8)--it's a fairly complicated business. Not for the faint of heart.

Dec 24, 2014 9:09 AM in response to Loner T

Could you clarify your answer for me? I'm a newbie here. Do you mean that Yosemite silently installed the patch for Snow Leopard?

I have Yosemite installed on an external Hard drive connected to my iMac running Snow Leopard. Does that mean I can run Snow Leopard on my iMac now without worrying about Security Updates? Should I turn Automatic Date and Time in Snow Leopard's system prefs back on?


I have no idea what NTP means or refers to.

Dec 24, 2014 9:13 AM in response to Loner T

I followed the link in the above discussion

About OS X NTP Security Update - Apple Support


and found this

OS X NTP Security Update

  • ntpdAvailable for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, OS X Yosemite v10.10.1Impact: A remote attacker may be able to execute arbitrary codeDescription: Several issues existed in ntpd that would have allowed an attacker to trigger buffer overflows. These issues were addressed through improved error checking.To verify the ntpd version, type the following command in Terminal: what /usr/sbin/ntpd. This update includes the following versions:
    • Mountain Lion: ntp-77.1.1
    • Mavericks: ntp-88.1.1
    • Yosemite: ntp-92.5.1
  • Does this imply that Snow Leopard does not have that Security update?

Dec 24, 2014 9:27 AM in response to caroldurga

There is no update for Snow. If you were booted to Yos, and if you stayed there long enough, the update would have installed. To check if it installed, visit Software Update while booted to Yos. If it's still showing as available, just run it directly from there. But it the update there will do nothing to patch the vulnerability in Snow.

Dec 24, 2014 12:12 PM in response to WZZZ

To me 10.6.8 is still the best OS X Apple ever released and I patched my system just like the shellshock back in September. It's really easy if you have some basic shell skills and XCODE installed,


Here is what I did, it may save you some time:


open the terminal app


1) Download the source code, apply the patch (I got the source code links from the ntp site)


cd ~

mkdir ntpd-fix

cd ntpd-fix

curl http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8.tar.gz | tar zxf -


2) Patch and compile the ntp source code


cd ntp-4.2.8/ntpd

curl http://bugs.ntp.org/attachment.cgi?id=1165 | patch -p1

cd ..

./configure && make


3) Open the system preferences - Date & Time - uncheck Set date and time automatically (to stop the process)

4) Rename the old object and then replace/copy them with the new objects


cd /usr/bin

sudo mv sntp sntp.old

sudo mv ntpq ntpq.old

sudo mv ntp-keygen ntp-keygen.old


cd /usr/sbin

sudo mv ntpdc ntpdc.old

sudo mv ntpdate ntpdate.old

sudo mv ntpd ntpd.old


cd ~/ntpd-fix/ntp-4.2.8

sudo cp sntp/sntp /usr/bin

sudo cp util/ntp-keygen /usr/bin

sudo cp ntpq/ntpq /usr/bin

sudo cp ntpdc/ntpdc /usr/sbin

sudo cp ntpdate/ntpdate /usr/sbin

sudo cp ntpd/ntpd /usr/sbin


sudo chown root:wheel /usr/bin/sntp

sudo chown root:wheel /usr/bin/ntp-keygen

sudo chown root:wheel /usr/bin/ntpq

sudo chown root:wheel /usr/sbin/ntpdc

sudo chown root:wheel /usr/sbin/ntpdate

sudo chown root:wheel /usr/sbin/ntpd


5) Open the system preferences - Date & Time - uncheck Set date and time automatically (to start the process)

6) Done.


-- update time manually

sudo ntpdate -u time.apple.com


-- check ntpd version (should now be: ntpd 4.2.8@1.3265-o)

sudo ntpd --version

Dec 24, 2014 4:01 PM in response to WZZZ

Originally posted at http://apple.stackexchange.com/questions/163209/disabling-ntp-on-os-x-lion-or-ol der/163234#163234 (see second answer) and updated with more info at http://www.macissues.com/2014/12/24/how-to-manually-patch-ntp-for-os-x-10-6-and- 10-7/. Do note that there's a beta update package, nt.-4.2.8p1-beta1.tar.gz at http://support.ntp.org/bin/view/Main/SoftwareDownloads which supposedly makes the installation easier. However, I updated my SL version last night without using the beta version.😎

Snow Leopard users: Turn off automatic date and time in System Preferences immediately

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.