Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Snow Leopard users: Turn off automatic date and time in System Preferences immediately

http://arstechnica.com/apple/2014/12/apple-automatically-patches-macs-to-fix-sev ere-ntp-security-flaw/


When exploited, the NTP flaw can cause buffer overflows that allow remote attackers to execute code on your system.

What this means is that, if you allow date and time to be set automatically by outside servers, you risk having your computer taken over.


This is a critical issue, it's being exploited as we speak, and Apple has not provided the update to Snow Leopard users, only to 10.8/Mountain Lion and above. I strongly doubt Apple will ever get around to issuing an update for Snow Leopard, or they would have already. Chances of that happening are close to zero

Posted on Dec 23, 2014 4:34 PM

Reply
175 replies

Jan 23, 2015 2:22 PM in response to Anwar Shiekh

Anwar Shiekh wrote:


I assume you have no problem generating the PPC binaries even without access to 10.5


Correct. I even have a ppc, i386, x86_64 build sitting on my desktop! 😉


I've also inspected the effect of my 10.5 tweaks for handling the ntpd-wrapper in install and restore (i.e., it simply doesn't install the modified ntpd-wrapper into a 10.5 target). Package creation was tweaked differently in that in order to not require OS X version specific installers I tweaked it to let the installer install the modified ntpd-wrapper but the package's preflight renames the original ntpd-wrapper, lets the install to proceed, and then overwrites the now installed modified ntpd-wrapper with the original in postflight (all this only for a 10.5 target of course). The end result is the same. The ntpd-wrapper is still the original 10.5 version.


By the way, I did add a test option to my script to not do all this for 10.5 while I was still thinking about these changes and they were fresh in my mind. I did that with the hope that the updated ntpd-wrapper could be experimented with on 10.5. If it works, and I believe it should, then I wouldn't need the 10.5-specific tweaks. I just can't seem to leave this script alone! Not sure why. It's just another shell script. I keep screwing around with it which is why I haven't bothered to reboot to complete the testing.

Jan 23, 2015 2:36 PM in response to Anwar Shiekh

As I just described the script can create universal binaries and installers to go with them since the installer sees what version of the target OSX it is installing into at install time and dynamically handles that ntpd-wrapper accordingly. That's what I meant about not having a OSX version-specific installer.


It has to know what the target version is anyhow since it checks to make sure you can only install when the target is 10.5, 10.6, or 10.7. This was why I was asking some time back about what should be the valid targets for these updaters.

Jan 23, 2015 3:03 PM in response to Anwar Shiekh

The whole idea behind making a package installer is that you (one who can use the script and has the dev tools) could build and give the installer away to others that don't have the dev. tools.


However, this now did bring up a concern of only I just thought of. My preflight/postflight/InstallationCheck installer scripts are bash scripts that of course use a few commands. Since I never had a system that I didn't install the dev. tools I am not sure what is and what is not in a base system without the dev. tools.


Here's a list of the commands the scripts use (I think I caught them all). Do you (or anyone reading this) know if these are always installed without the dev tools installed? I would of course have to try to make adjustments to these scripts if some are not available.


/bin/ps

/usr/bin/grep

/usr/bin/fgrep

/bin/rm

/bin/launchctl (duh! we know that's got to be in there)

/usr/bin/touch

/usr/bin/sw_vers

/usr/bin/wc

/usr/bin/uname

/bin/echo

Jan 23, 2015 11:00 PM in response to Anwar Shiekh

Thanks.


FWIW as for my question about whether or not the tools the script's package installer uses are in a OSX installation without the xcode dev. tools, curiosity got the best of me. But I didn't want to install a fresh system. So I pulled out my old 10.6.4 installer dvd and started exploring it with Pacifist. It turns out all the commands I use are in a standard installation (whew!) so no xcode dev tools would be required to use the ntp installers.


Not that anyone would really care but for future reference (in case anyone with a similar problem cares in the future and finds this thread) here's the installer packages I found the tools I use in the installer dvd (package name on the left and I reorganized my list of commands to group them by directlory):

Essentials.pkg /usr/bin/fgrep

Essentials.pkg /usr/bin/grep

Essentials.pkg /usr/bin/sw_vers

BaseSystem.pkg /usr/bin/touch

Essentials.pkg /usr/bin/uname

BaseSystem.pkg /usr/bin/wc


BaseSystem.pkg /bin/echo

BaseSystem.pkg /bin/launchctl

BaseSystem.pkg /bin/mv

BaseSystem.pkg /bin/ps

BaseSystem.pkg /bin/rm


I don't think think these two packages are optional in a OSX install (based on their names😉) and I also assume this is almost certainly the same on 10.5 and 10.7.

Jan 25, 2015 5:52 PM in response to Anwar Shiekh

With what? The testing? If so, yes. It all appears to be working on my test boot volume (using the ntp beta5). Backups, restores, installs, and installer packages (for both backups and new versions) all seem to work. Building has always worked since I didn't need a separate test boot volume to debug all that.


But as usual, I can't leave the thing alone.


After noticing how I was actually using my script's command line options in real use (as opposed to just testing all the functions). I realized I had made the options overly and unnecessarily complicated (in their relationships to each other) and somewhat confusing. So as we speak I am in the process of simplifying them. This is basically "front end" stuff while the actual machinery (the code that uses the options) doesn't need changing too much.


Of course after all the option handling changes I need to go back and change all the documentation. Hope to do that tonight. Doing the documentation also helps me clarify my thinking on how these options relate to each other. I sort of suspected I was making things too complicated when I documented what I had. It just didn't "feel" right even then.

Jan 26, 2015 6:03 PM in response to xyzzy-xyzzy

Things have moved to 4.2.8p1-RC1


---

(4.2.8p1-RC1) 2015/01/24 Released by Harlan Stenn <stenn@ntp.org>


* Start the RC for 4.2.8p1.

* [Bug 2187] Update version number generation scripts.

* [Bug 2617] Fix sntp Usage documentation section.

* [Sec 2672] Code cleanup: On some OSes ::1 can be spoofed...

* [Bug 2736] Show error message if we cannot open the config file.

* Copyright update.

* Fix the package name.

---

(4.2.8p1-beta5) 2015/01/07 Released by Harlan Stenn <stenn@ntp.org>


* [Bug 2728] Work around C99-style structure initialization code

for older compilers, specifically Visual Studio prior to VS2013.

* [Bug 2695] Windows build: __func__ not supported under Windows.

---

(4.2.8p1-beta4) 2015/01/04 Released by Harlan Stenn <stenn@ntp.org>


* Fix a regression introduced to timepps-Solaris.h as part of:

[Bug 1206] Required compiler changes for Windows

(4.2.5p181) 2009/06/06

* [Bug 1084] PPSAPI for ntpd on Windows with DLL backends

* [Bug 2695] Build problem on Windows (sys/socket.h).

* [Bug 2715] mdnstries option for ntp.conf from NetBSD.

---

(4.2.8p1-beta3) 2015/01/02 Released by Harlan Stenn <stenn@ntp.org>


* [Bug 2627] shm refclock allows only two units with owner-only access

Use mode bit 0 to select public access for units >= 2 (units 0 & 1 are

always private.

* [Bug 2681] Fix display of certificate EOValidity dates on 32-bit systems.

* [Bug 2695] 4.2.8 does not build on Windows.

* [bug 2700] mrulist stopped working in 4.2.8.

* [Bug 2706] libparse/info_trimble.c build dependencies are broken.

* [Bug 2713] variable type/cast, parameter name, general cleanup from NetBSD.

* [Bug 2714] libevent may need to be built independently of any build of sntp.

* [Bug 2715] mdnstries option for ntp.conf from NetBSD.

---

(4.2.8p1-beta2) 2014/12/27 Released by Harlan Stenn <stenn@ntp.org>


* [Bug 2674] Install sntp in sbin on NetBSD.

* [Bug 2693] ntp-keygen doesn't build without OpenSSL and sntp.

* [Bug 2707] Avoid a C90 extension in libjsmn/jsmn.c.

* [Bug 2709] see if we have a C99 compiler (not yet required).

---

(4.2.8p1-beta1) 2014/12/23 Released by Harlan Stenn <stenn@ntp.org>


* [Sec 2672] On some OSes ::1 can be spoofed, bypassing source IP ACLs.

* [Bug 2693] ntp-keygen doesn't build without OpenSSL.

* [Bug 2697] IN6_IS_ADDR_LOOPBACK build problems on some OSes.

* [Bug 2699] HAVE_SYS_SELECT_H is misspelled in refclock_gpsdjson.c.

---

(4.2.8) 2014/12/19 Released by Harlan Stenn <stenn@ntp.org>


* [Sec 730] Increase RSA_generate_key modulus.

* [Sec 2666] Use cryptographic random numbers for md5 key generation.

* [Sec 2667] buffer overflow in crypto_recv().

* [Sec 2668] buffer overflow in ctl_putdata().

* [Sec 2669] buffer overflow in configure().

* [Sec 2670] Missing return; from error clause.

* [Sec 2671] vallen in extension fields are not validated.

* [Sec 2672] On some OSes ::1 can be spoofed, bypassing source IP ACLs.

* [Bug 2691] Wrong variable name in refclock_ripencc.c.

Snow Leopard users: Turn off automatic date and time in System Preferences immediately

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.