Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Snow Leopard users: Turn off automatic date and time in System Preferences immediately

http://arstechnica.com/apple/2014/12/apple-automatically-patches-macs-to-fix-sev ere-ntp-security-flaw/


When exploited, the NTP flaw can cause buffer overflows that allow remote attackers to execute code on your system.

What this means is that, if you allow date and time to be set automatically by outside servers, you risk having your computer taken over.


This is a critical issue, it's being exploited as we speak, and Apple has not provided the update to Snow Leopard users, only to 10.8/Mountain Lion and above. I strongly doubt Apple will ever get around to issuing an update for Snow Leopard, or they would have already. Chances of that happening are close to zero

Posted on Dec 23, 2014 4:34 PM

Reply
175 replies

Dec 24, 2014 7:04 PM in response to pcbjr

I build a quick and easy installer using my newly complied binaries, if you don't feel comfortable compiling your own code.


Note: I searched for the solution online, compiled it and put it in an installer package to make it easier. Of course Install at your own risk, but it worked on my MacBook Pro i7 and MacBook Air Core 2 Duo both running 10.6.8.


You can download my installer from here.

https://drive.google.com/file/d/0BxQCbeIgpA2uYzBOSktXM3F0VjA/view?usp=sharing


1) install package

It will install the following files and should: (version of ntp 4.2.8)


/usr/bin/sntp

/usr/bin/ntp-keygen

/usr/bin/ntpq

/usr/sbin/ntpdc

/usr/sbin/ntpdate

/usr/sbin/ntpd


2) Reboot or Open the system preferences - Date & Time - uncheck Set date and time automatically (to stop the process) and check it again to start the ntpd again using the new binary,

Dec 25, 2014 4:07 PM in response to WZZZ

I am seriously beginning not to trust Apple. Failing to cover the security needs of a well regarded and popular OS is dreadful. It is tantamount to forcing people to upgrade when it could involve them in considerable on-costs in terms of replacing existing PPC programs or upgrading HDs. Big thank you, WZZZ, for drawing our attention to this matter.

Dec 25, 2014 5:22 PM in response to pcbjr

The way I know, is to check the ntp version per command line. If it's not updated, the version will be version 4.2.4 (or something else than 4.2.8) on OS X 10.6.8


1) open Terminal.app (located in the utilities folder)

2) type the following or copy/paste and return: sudo ntpd --version

3) enter your computer admin password and it should return the version as below.


ntpd 4.2.8@1.3265-o Wed Dec 24 18:19:07 UTC 2014 (1)


Note: You can check the version of the other binaries the same way: sudo ntpd --version , sudo ntp-keygen --version, etc.

or check the file dates in /usr/bin and /use/sbin.

Dec 26, 2014 4:01 AM in response to flatsixracer

Thank you very much for the executable package. At the same download address, and with your permission, I also dowloaded the ShellShock fix which I still hadn't applied to my macs. Both of them seem to have done the trick. We should stick together and try to provide among ourselves "unofficial" support to this wonderful OS. I'm not in the mood of "following" this new yearly OS X updates schedule neither buying a new equipment when the two I own develop an absolutely awesome peformance in every task I need. Programmed obsolescence? Of course, but not with me. Maybe next time it will be Fedora + non internet connection OS X Snow Leopard.

Dec 27, 2014 7:04 AM in response to WZZZ

flatsixracer wrote: check ntpd version (should now be: ntpd 4.2.8@1.3265-o)

On my 10.6, I got ntpd 4.2.8@1.3265, no -o. But on my old G3/10.4.11 I got the -o. Any idea what the -o stands for? Someone elsewhere was thinking it could refer to the processor optimization command used during compiling.

Snow Leopard users: Turn off automatic date and time in System Preferences immediately

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.