NEWS revision 1.1.1.1.6.2
1 1.1.1.1.6.2 yamt --- 2 1.1.1.1.6.2 yamt NTP 4.2.8- 3 1.1.1.1.6.2 yamt 4 1.1.1.1.6.2 yamt Important Changes 5 1.1.1.1.6.2 yamt 6 1.1.1.1.6.2 yamt * Internal NTP Era counters 7 1.1.1.1.6.2 yamt 8 1.1.1.1.6.2 yamt The internal counters that track which "era" (range of years) we are in 9 1.1.1.1.6.2 yamt rolls over every 136 years'. The current "era" started at the stroke of 10 1.1.1.1.6.2 yamt midnight on 1 Jan 1900, and ends just before the stroke of midnight on 11 1.1.1.1.6.2 yamt 1 Jan 2036. 12 1.1.1.1.6.2 yamt In the past, we have used the "midpoint" of the range to decide which 13 1.1.1.1.6.2 yamt era we were in. Given the longevity of some products, it became clear 14 1.1.1.1.6.2 yamt that it would be more functional to "look back" less, and "look forward" 15 1.1.1.1.6.2 yamt more. We now compile a timestamp into the ntpd executable and when we 16 1.1.1.1.6.2 yamt get a timestamp we us the "built-on" to tell us what era we are in. 17 1.1.1.1.6.2 yamt This check "looks back" 10 years, and "looks forward" 126 years. 18 1.1.1.1.6.2 yamt 19 1.1.1.1.6.2 yamt So if you have a system that ... 20 1.1.1.1.6.2 yamt 21 1.1.1.1.6.2 yamt * ntpdc responses disabled by default 22 1.1.1.1.6.2 yamt 23 1.1.1.1.6.2 yamt Dave Hart writes: 24 1.1.1.1.6.2 yamt 25 1.1.1.1.6.2 yamt For a long time, ntpq and its mostly text-based mode 6 (control) 26 1.1.1.1.6.2 yamt protocol have been preferred over ntpdc and its mode 7 (private 27 1.1.1.1.6.2 yamt request) protocol for runtime queries and configuration. There has 28 1.1.1.1.6.2 yamt been a goal of deprecating ntpdc, previously held back by numerous 29 1.1.1.1.6.2 yamt capabilities exposed by ntpdc with no ntpq equivalent. I have been 30 1.1.1.1.6.2 yamt adding commands to ntpq to cover these cases, and I believe I've 31 1.1.1.1.6.2 yamt covered them all, though I've not compared command-by-command 32 1.1.1.1.6.2 yamt recently. 33 1.1.1.1.6.2 yamt 34 1.1.1.1.6.2 yamt As I've said previously, the binary mode 7 protocol involves a lot of 35 1.1.1.1.6.2 yamt hand-rolled structure layout and byte-swapping code in both ntpd and 36 1.1.1.1.6.2 yamt ntpdc which is hard to get right. As ntpd grows and changes, the 37 1.1.1.1.6.2 yamt changes are difficult to expose via ntpdc while maintaining forward 38 1.1.1.1.6.2 yamt and backward compatibility between ntpdc and ntpd. In contrast, 39 1.1.1.1.6.2 yamt ntpq's text-based, label=value approach involves more code reuse and 40 1.1.1.1.6.2 yamt allows compatible changes without extra work in most cases. 41 1.1.1.1.6.2 yamt 42 1.1.1.1.6.2 yamt Mode 7 has always been defined as vendor/implementation-specific while 43 1.1.1.1.6.2 yamt mode 6 is described in RFC 1305 and intended to be open to interop 44 1.1.1.1.6.2 yamt with other implementations. There is an early draft of an updated 45 1.1.1.1.6.2 yamt mode 6 description that likely will join the other NTPv4 RFCs 46 1.1.1.1.6.2 yamt eventually. (http://tools.ietf.org/html/draft-odonoghue-ntpv4-control-01) 47 1.1.1.1.6.2 yamt 48 1.1.1.1.6.2 yamt For these reasons, ntpd 4.2.7p230 by default disables processing of 49 1.1.1.1.6.2 yamt ntpdc queries, reducing ntpd's attack surface and functionally 50 1.1.1.1.6.2 yamt deprecating ntpdc. If you are in the habit of using ntpdc for certain 51 1.1.1.1.6.2 yamt operations, please try the ntpq equivalent. If there's no equivalent, 52 1.1.1.1.6.2 yamt please open a bug report at http://bugs.ntp.org./ 53 1.1.1.1.6.2 yamt 54 1.1.1.1.6.1 yamt --- 55 1.1.1.1.6.1 yamt NTP 4.2.6p5 (Harlan Stenn <stenn (a] ntp.org>, 2011/12/24) 56 1.1.1.1.6.1 yamt 57 1.1.1.1.6.1 yamt Focus: Bug fixes 58 1.1.1.1.6.1 yamt 59 1.1.1.1.6.1 yamt Severity: Medium 60 1.1.1.1.6.1 yamt 61 1.1.1.1.6.1 yamt This is a recommended upgrade. 62 1.1.1.1.6.1 yamt 63 1.1.1.1.6.1 yamt This release updates sys_rootdisp and sys_jitter calculations to match the 64 1.1.1.1.6.1 yamt RFC specification, fixes a potential IPv6 address matching error for the 65 1.1.1.1.6.1 yamt "nic" and "interface" configuration directives, suppresses the creation of 66 1.1.1.1.6.1 yamt extraneous ephemeral associations for certain broadcastclient and 67 1.1.1.1.6.1 yamt multicastclient configurations, cleans up some ntpq display issues, and 68 1.1.1.1.6.1 yamt includes improvements to orphan mode, minor bugs fixes and code clean-ups. 69 1.1.1.1.6.1 yamt 70 1.1.1.1.6.1 yamt New features / changes in this release: 71 1.1.1.1.6.1 yamt 72 1.1.1.1.6.1 yamt ntpd 73 1.1.1.1.6.1 yamt 74 1.1.1.1.6.1 yamt * Updated "nic" and "interface" IPv6 address handling to prevent 75 1.1.1.1.6.1 yamt mismatches with localhost [::1] and wildcard [::] which resulted from 76 1.1.1.1.6.1 yamt using the address/prefix format (e.g. fe80::/64) 77 1.1.1.1.6.1 yamt * Fix orphan mode stratum incorrectly counting to infinity 78 1.1.1.1.6.1 yamt * Orphan parent selection metric updated to includes missing ntohl() 79 1.1.1.1.6.1 yamt * Non-printable stratum 16 refid no longer sent to ntp 80 1.1.1.1.6.1 yamt * Duplicate ephemeral associations suppressed for broadcastclient and 81 1.1.1.1.6.1 yamt multicastclient without broadcastdelay 82 1.1.1.1.6.1 yamt * Exclude undetermined sys_refid from use in loopback TEST12 83 1.1.1.1.6.1 yamt * Exclude MODE_SERVER responses from KoD rate limiting 84 1.1.1.1.6.1 yamt * Include root delay in clock_update() sys_rootdisp calculations 85 1.1.1.1.6.1 yamt * get_systime() updated to exclude sys_residual offset (which only 86 1.1.1.1.6.1 yamt affected bits "below" sys_tick, the precision threshold) 87 1.1.1.1.6.1 yamt * sys.peer jitter weighting corrected in sys_jitter calculation 88 1.1.1.1.6.1 yamt 89 1.1.1.1.6.1 yamt ntpq 90 1.1.1.1.6.1 yamt 91 1.1.1.1.6.1 yamt * -n option extended to include the billboard "server" column 92 1.1.1.1.6.1 yamt * IPv6 addresses in the local column truncated to prevent overruns 93 1.1.1.1.6.1 yamt 94 1.1.1.1.6.1 yamt --- 95 1.1.1.1.6.1 yamt NTP 4.2.6p4 (Harlan Stenn <stenn (a] ntp.org>, 2011/09/22) 96 1.1.1.1.6.1 yamt 97 1.1.1.1.6.1 yamt Focus: Bug fixes and portability improvements 98 1.1.1.1.6.1 yamt 99 1.1.1.1.6.1 yamt Severity: Medium 100 1.1.1.1.6.1 yamt 101 1.1.1.1.6.1 yamt This is a recommended upgrade. 102 1.1.1.1.6.1 yamt 103 1.1.1.1.6.1 yamt This release includes build infrastructure updates, code 104 1.1.1.1.6.1 yamt clean-ups, minor bug fixes, fixes for a number of minor 105 1.1.1.1.6.1 yamt ref-clock issues, and documentation revisions. 106 1.1.1.1.6.1 yamt 107 1.1.1.1.6.1 yamt Portability improvements affect AIX, HP-UX, Linux, OS X and 64-bit time_t. 108 1.1.1.1.6.1 yamt 109 1.1.1.1.6.1 yamt New features / changes in this release: 110 1.1.1.1.6.1 yamt 111 1.1.1.1.6.1 yamt Build system 112 1.1.1.1.6.1 yamt 113 1.1.1.1.6.1 yamt * Fix checking for struct rtattr 114 1.1.1.1.6.1 yamt * Update config.guess and config.sub for AIX 115 1.1.1.1.6.1 yamt * Upgrade required version of autogen and libopts for building 116 1.1.1.1.6.1 yamt from our source code repository 117 1.1.1.1.6.1 yamt 118 1.1.1.1.6.1 yamt ntpd 119 1.1.1.1.6.1 yamt 120 1.1.1.1.6.1 yamt * Back-ported several fixes for Coverity warnings from ntp-dev 121 1.1.1.1.6.1 yamt * Fix a rare boundary condition in UNLINK_EXPR_SLIST() 122 1.1.1.1.6.1 yamt * Allow "logconfig =allall" configuration directive 123 1.1.1.1.6.1 yamt * Bind tentative IPv6 addresses on Linux 124 1.1.1.1.6.1 yamt * Correct WWVB/Spectracom driver to timestamp CR instead of LF 125 1.1.1.1.6.1 yamt * Improved tally bit handling to prevent incorrect ntpq peer status reports 126 1.1.1.1.6.1 yamt * Exclude the Undisciplined Local Clock and ACTS drivers from the initial 127 1.1.1.1.6.1 yamt candidate list unless they are designated a "prefer peer" 128 1.1.1.1.6.1 yamt * Prevent the consideration of Undisciplined Local Clock or ACTS drivers for 129 1.1.1.1.6.1 yamt selection during the 'tos orphanwait' period 130 1.1.1.1.6.1 yamt * Prefer an Orphan Mode Parent over the Undisciplined Local Clock or ACTS 131 1.1.1.1.6.1 yamt drivers 132 1.1.1.1.6.1 yamt * Improved support of the Parse Refclock trusttime flag in Meinberg mode 133 1.1.1.1.6.1 yamt * Back-port utility routines from ntp-dev: mprintf(), emalloc_zero() 134 1.1.1.1.6.1 yamt * Added the NTPD_TICKADJ_PPM environment variable for specifying baseline 135 1.1.1.1.6.1 yamt clock slew on Microsoft Windows 136 1.1.1.1.6.1 yamt * Code cleanup in libntpq 137 1.1.1.1.6.1 yamt 138 1.1.1.1.6.1 yamt ntpdc 139 1.1.1.1.6.1 yamt 140 1.1.1.1.6.1 yamt * Fix timerstats reporting 141 1.1.1.1.6.1 yamt 142 1.1.1.1.6.1 yamt ntpdate 143 1.1.1.1.6.1 yamt 144 1.1.1.1.6.1 yamt * Reduce time required to set clock 145 1.1.1.1.6.1 yamt * Allow a timeout greater than 2 seconds 146 1.1.1.1.6.1 yamt 147 1.1.1.1.6.1 yamt sntp 148 1.1.1.1.6.1 yamt 149 1.1.1.1.6.1 yamt * Backward incompatible command-line option change: 150 1.1.1.1.6.1 yamt -l/--filelog changed -l/--logfile (to be consistent with ntpd) 151 1.1.1.1.6.1 yamt 152 1.1.1.1.6.1 yamt Documentation 153 1.1.1.1.6.1 yamt 154 1.1.1.1.6.1 yamt * Update html2man. Fix some tags in the .html files 155 1.1.1.1.6.1 yamt * Distribute ntp-wait.html 156 1.1.1.1.6.1 yamt 157 1.1.1.1.6.1 yamt --- 158 1.1.1.1.6.1 yamt NTP 4.2.6p3 (Harlan Stenn <stenn (a] ntp.org>, 2011/01/03) 159 1.1.1.1.6.1 yamt 160 1.1.1.1.6.1 yamt Focus: Bug fixes and portability improvements 161 1.1.1.1.6.1 yamt 162 1.1.1.1.6.1 yamt Severity: Medium 163 1.1.1.1.6.1 yamt 164 1.1.1.1.6.1 yamt This is a recommended upgrade. 165 1.1.1.1.6.1 yamt 166 1.1.1.1.6.1 yamt This release includes build infrastructure updates, code 167 1.1.1.1.6.1 yamt clean-ups, minor bug fixes, fixes for a number of minor 168 1.1.1.1.6.1 yamt ref-clock issues, and documentation revisions. 169 1.1.1.1.6.1 yamt 170 1.1.1.1.6.1 yamt Portability improvements in this release affect AIX, Atari FreeMiNT, 171 1.1.1.1.6.1 yamt FreeBSD4, Linux and Microsoft Windows. 172 1.1.1.1.6.1 yamt 173 1.1.1.1.6.1 yamt New features / changes in this release: 174 1.1.1.1.6.1 yamt 175 1.1.1.1.6.1 yamt Build system 176 1.1.1.1.6.1 yamt * Use lsb_release to get information about Linux distributions. 177 1.1.1.1.6.1 yamt * 'test' is in /usr/bin (instead of /bin) on some systems. 178 1.1.1.1.6.1 yamt * Basic sanity checks for the ChangeLog file. 179 1.1.1.1.6.1 yamt * Source certain build files with ./filename for systems without . in PATH. 180 1.1.1.1.6.1 yamt * IRIX portability fix. 181 1.1.1.1.6.1 yamt * Use a single copy of the "libopts" code. 182 1.1.1.1.6.1 yamt * autogen/libopts upgrade. 183 1.1.1.1.6.1 yamt * configure.ac m4 quoting cleanup. 184 1.1.1.1.6.1 yamt 185 1.1.1.1.6.1 yamt ntpd 186 1.1.1.1.6.1 yamt * Do not bind to IN6_IFF_ANYCAST addresses. 187 1.1.1.1.6.1 yamt * Log the reason for exiting under Windows. 188 1.1.1.1.6.1 yamt * Multicast fixes for Windows. 189 1.1.1.1.6.1 yamt * Interpolation fixes for Windows. 190 1.1.1.1.6.1 yamt * IPv4 and IPv6 Multicast fixes. 191 1.1.1.1.6.1 yamt * Manycast solicitation fixes and general repairs. 192 1.1.1.1.6.1 yamt * JJY refclock cleanup. 193 1.1.1.1.6.1 yamt * NMEA refclock improvements. 194 1.1.1.1.6.1 yamt * Oncore debug message cleanup. 195 1.1.1.1.6.1 yamt * Palisade refclock now builds under Linux. 196 1.1.1.1.6.1 yamt * Give RAWDCF more baud rates. 197 1.1.1.1.6.1 yamt * Support Truetime Satellite clocks under Windows. 198 1.1.1.1.6.1 yamt * Support Arbiter 1093C Satellite clocks under Windows. 199 1.1.1.1.6.1 yamt * Make sure that the "filegen" configuration command defaults to "enable". 200 1.1.1.1.6.1 yamt * Range-check the status codes (plus other cleanup) in the RIPE-NCC driver. 201 1.1.1.1.6.1 yamt * Prohibit 'includefile' directive in remote configuration command. 202 1.1.1.1.6.1 yamt * Fix 'nic' interface bindings. 203 1.1.1.1.6.1 yamt * Fix the way we link with openssl if openssl is installed in the base 204 1.1.1.1.6.1 yamt system. 205 1.1.1.1.6.1 yamt 206 1.1.1.1.6.1 yamt ntp-keygen 207 1.1.1.1.6.1 yamt * Fix -V coredump. 208 1.1.1.1.6.1 yamt * OpenSSL version display cleanup. 209 1.1.1.1.6.1 yamt 210 1.1.1.1.6.1 yamt ntpdc 211 1.1.1.1.6.1 yamt * Many counters should be treated as unsigned. 212 1.1.1.1.6.1 yamt 213 1.1.1.1.6.1 yamt ntpdate 214 1.1.1.1.6.1 yamt * Do not ignore replies with equal receive and transmit timestamps. 215 1.1.1.1.6.1 yamt 216 1.1.1.1.6.1 yamt ntpq 217 1.1.1.1.6.1 yamt * libntpq warning cleanup. 218 1.1.1.1.6.1 yamt 219 1.1.1.1.6.1 yamt ntpsnmpd 220 1.1.1.1.6.1 yamt * Correct SNMP type for "precision" and "resolution". 221 1.1.1.1.6.1 yamt * Update the MIB from the draft version to RFC-5907. 222 1.1.1.1.6.1 yamt 223 1.1.1.1.6.1 yamt sntp 224 1.1.1.1.6.1 yamt * Display timezone offset when showing time for sntp in the local 225 1.1.1.1.6.1 yamt timezone. 226 1.1.1.1.6.1 yamt * Pay proper attention to RATE KoD packets. 227 1.1.1.1.6.1 yamt * Fix a miscalculation of the offset. 228 1.1.1.1.6.1 yamt * Properly parse empty lines in the key file. 229 1.1.1.1.6.1 yamt * Logging cleanup. 230 1.1.1.1.6.1 yamt * Use tv_usec correctly in set_time(). 231 1.1.1.1.6.1 yamt * Documentation cleanup. 232 1.1.1.1.6.1 yamt 233 1.1.1.1.6.1 yamt --- 234 1.1.1.1.6.1 yamt NTP 4.2.6p2 (Harlan Stenn <stenn (a] ntp.org>, 2010/07/08) 235 1.1.1.1.6.1 yamt 236 1.1.1.1.6.1 yamt Focus: Bug fixes and portability improvements 237 1.1.1.1.6.1 yamt 238 1.1.1.1.6.1 yamt Severity: Medium 239 1.1.1.1.6.1 yamt 240 1.1.1.1.6.1 yamt This is a recommended upgrade. 241 1.1.1.1.6.1 yamt 242 1.1.1.1.6.1 yamt This release includes build infrastructure updates, code 243 1.1.1.1.6.1 yamt clean-ups, minor bug fixes, fixes for a number of minor 244 1.1.1.1.6.1 yamt ref-clock issues, improved KOD handling, OpenSSL related 245 1.1.1.1.6.1 yamt updates and documentation revisions. 246 1.1.1.1.6.1 yamt 247 1.1.1.1.6.1 yamt Portability improvements in this release affect Irix, Linux, 248 1.1.1.1.6.1 yamt Mac OS, Microsoft Windows, OpenBSD and QNX6 249 1.1.1.1.6.1 yamt 250 1.1.1.1.6.1 yamt New features / changes in this release: 251 1.1.1.1.6.1 yamt 252 1.1.1.1.6.1 yamt ntpd 253 1.1.1.1.6.1 yamt * Range syntax for the trustedkey configuration directive 254 1.1.1.1.6.1 yamt * Unified IPv4 and IPv6 restrict lists 255 1.1.1.1.6.1 yamt 256 1.1.1.1.6.1 yamt ntpdate 257 1.1.1.1.6.1 yamt * Rate limiting and KOD handling 258 1.1.1.1.6.1 yamt 259 1.1.1.1.6.1 yamt ntpsnmpd 260 1.1.1.1.6.1 yamt * default connection to net-snmpd via a unix-domain socket 261 1.1.1.1.6.1 yamt * command-line 'socket name' option 262 1.1.1.1.6.1 yamt 263 1.1.1.1.6.1 yamt ntpq / ntpdc 264 1.1.1.1.6.1 yamt * support for the "passwd ..." syntax 265 1.1.1.1.6.1 yamt * key-type specific password prompts 266 1.1.1.1.6.1 yamt 267 1.1.1.1.6.1 yamt sntp 268 1.1.1.1.6.1 yamt * MD5 authentication of an ntpd 269 1.1.1.1.6.1 yamt * Broadcast and crypto 270 1.1.1.1.6.1 yamt * OpenSSL support 271 1.1.1.1.6.1 yamt 272 1.1.1.1.6.1 yamt --- 273 1.1.1.1.6.1 yamt NTP 4.2.6p1 (Harlan Stenn <stenn (a] ntp.org>, 2010/04/09) 274 1.1.1.1.6.1 yamt 275 1.1.1.1.6.1 yamt Focus: Bug fixes, portability fixes, and documentation improvements 276 1.1.1.1.6.1 yamt 277 1.1.1.1.6.1 yamt Severity: Medium 278 1.1.1.1.6.1 yamt 279 1.1.1.1.6.1 yamt This is a recommended upgrade. 280 1.1.1.1.6.1 yamt 281 1.1.1.1.6.1 yamt --- 282 1.1.1.1.6.1 yamt NTP 4.2.6 (Harlan Stenn <stenn (a] ntp.org>, 2009/12/08) 283 1.1.1.1.6.1 yamt 284 1.1.1.1.6.1 yamt Focus: enhancements and bug fixes. 285 1.1.1.1.6.1 yamt 286 1.1.1.1.6.1 yamt --- 287 1.1 kardel NTP 4.2.4p8 (Harlan Stenn <stenn (a] ntp.org>, 2009/12/08) 288 1.1 kardel 289 1.1 kardel Focus: Security Fixes 290 1.1 kardel 291 1.1 kardel Severity: HIGH 292 1.1 kardel 293 1.1 kardel This release fixes the following high-severity vulnerability: 294 1.1 kardel 295 1.1 kardel * [Sec 1331] DoS with mode 7 packets - CVE-2009-3563. 296 1.1 kardel 297 1.1 kardel See http://support.ntp.org/security for more information. 298 1.1 kardel 299 1.1 kardel NTP mode 7 (MODE_PRIVATE) is used by the ntpdc query and control utility. 300 1.1 kardel In contrast, ntpq uses NTP mode 6 (MODE_CONTROL), while routine NTP time 301 1.1 kardel transfers use modes 1 through 5. Upon receipt of an incorrect mode 7 302 1.1 kardel request or a mode 7 error response from an address which is not listed 303 1.1 kardel in a "restrict ... noquery" or "restrict ... ignore" statement, ntpd will 304 1.1 kardel reply with a mode 7 error response (and log a message). In this case: 305 1.1 kardel 306 1.1 kardel * If an attacker spoofs the source address of ntpd host A in a 307 1.1 kardel mode 7 response packet sent to ntpd host B, both A and B will 308 1.1 kardel continuously send each other error responses, for as long as 309 1.1 kardel those packets get through. 310 1.1 kardel 311 1.1 kardel * If an attacker spoofs an address of ntpd host A in a mode 7 312 1.1 kardel response packet sent to ntpd host A, A will respond to itself 313 1.1 kardel endlessly, consuming CPU and logging excessively. 314 1.1 kardel 315 1.1 kardel Credit for finding this vulnerability goes to Robin Park and Dmitri 316 1.1 kardel Vinokurov of Alcatel-Lucent. 317 1.1 kardel 318 1.1 kardel THIS IS A STRONGLY RECOMMENDED UPGRADE. 319 1.1 kardel 320 1.1 kardel --- 321 1.1 kardel ntpd now syncs to refclocks right away. 322 1.1 kardel 323 1.1.1.1.6.1 yamt Backward-Incompatible changes: 324 1.1 kardel 325 1.1 kardel ntpd no longer accepts '-v name' or '-V name' to define internal variables. 326 1.1 kardel Use '--var name' or '--dvar name' instead. (Bug 817) 327 1.1 kardel 328 1.1 kardel --- 329 1.1 kardel NTP 4.2.4p7 (Harlan Stenn <stenn (a] ntp.org>, 2009/05/04) 330 1.1 kardel 331 1.1 kardel Focus: Security and Bug Fixes 332 1.1 kardel 333 1.1 kardel Severity: HIGH 334 1.1 kardel 335 1.1 kardel This release fixes the following high-severity vulnerability: 336 1.1 kardel 337 1.1 kardel * [Sec 1151] Remote exploit if autokey is enabled. CVE-2009-1252 338 1.1 kardel 339 1.1 kardel See http://support.ntp.org/security for more information. 340 1.1 kardel 341 1.1 kardel If autokey is enabled (if ntp.conf contains a "crypto pw whatever" 342 1.1 kardel line) then a carefully crafted packet sent to the machine will cause 343 1.1 kardel a buffer overflow and possible execution of injected code, running 344 1.1 kardel with the privileges of the ntpd process (often root). 345 1.1 kardel 346 1.1 kardel Credit for finding this vulnerability goes to Chris Ries of CMU. 347 1.1 kardel 348 1.1 kardel This release fixes the following low-severity vulnerabilities: 349 1.1 kardel 350 1.1 kardel * [Sec 1144] limited (two byte) buffer overflow in ntpq. CVE-2009-0159 351 1.1 kardel Credit for finding this vulnerability goes to Geoff Keating of Apple. 352 1.1 kardel 353 1.1 kardel * [Sec 1149] use SO_EXCLUSIVEADDRUSE on Windows 354 1.1 kardel Credit for finding this issue goes to Dave Hart. 355 1.1 kardel 356 1.1 kardel This release fixes a number of bugs and adds some improvements: 357 1.1 kardel 358 1.1 kardel * Improved logging 359 1.1 kardel * Fix many compiler warnings 360 1.1 kardel * Many fixes and improvements for Windows 361 1.1 kardel * Adds support for AIX 6.1 362 1.1 kardel * Resolves some issues under MacOS X and Solaris 363 1.1 kardel 364 1.1 kardel THIS IS A STRONGLY RECOMMENDED UPGRADE. 365 1.1 kardel 366 1.1 kardel --- 367 1.1 kardel NTP 4.2.4p6 (Harlan Stenn <stenn (a] ntp.org>, 2009/01/07) 368 1.1 kardel 369 1.1 kardel Focus: Security Fix 370 1.1 kardel 371 1.1 kardel Severity: Low 372 1.1 kardel 373 1.1 kardel This release fixes oCERT.org's CVE-2009-0021, a vulnerability affecting 374 1.1 kardel the OpenSSL library relating to the incorrect checking of the return 375 1.1 kardel value of EVP_VerifyFinal function. 376 1.1 kardel 377 1.1 kardel Credit for finding this issue goes to the Google Security Team for 378 1.1 kardel finding the original issue with OpenSSL, and to ocert.org for finding 379 1.1 kardel the problem in NTP and telling us about it. 380 1.1 kardel 381 1.1 kardel This is a recommended upgrade. 382 1.1 kardel --- 383 1.1 kardel NTP 4.2.4p5 (Harlan Stenn <stenn (a] ntp.org>, 2008/08/17) 384 1.1 kardel 385 1.1 kardel Focus: Minor Bugfixes 386 1.1 kardel 387 1.1 kardel This release fixes a number of Windows-specific ntpd bugs and 388 1.1 kardel platform-independent ntpdate bugs. A logging bugfix has been applied 389 1.1 kardel to the ONCORE driver. 390 1.1 kardel 391 1.1 kardel The "dynamic" keyword and is now obsolete and deferred binding to local 392 1.1 kardel interfaces is the new default. The minimum time restriction for the 393 1.1 kardel interface update interval has been dropped. 394 1.1 kardel 395 1.1 kardel A number of minor build system and documentation fixes are included. 396 1.1 kardel 397 1.1 kardel This is a recommended upgrade for Windows. 398 1.1 kardel 399 1.1 kardel --- 400 1.1 kardel NTP 4.2.4p4 (Harlan Stenn <stenn (a] ntp.org>, 2007/09/10) 401 1.1 kardel 402 1.1 kardel Focus: Minor Bugfixes 403 1.1 kardel 404 1.1 kardel This release updates certain copyright information, fixes several display 405 1.1 kardel bugs in ntpdc, avoids SIGIO interrupting malloc(), cleans up file descriptor 406 1.1 kardel shutdown in the parse refclock driver, removes some lint from the code, 407 1.1 kardel stops accessing certain buffers immediately after they were freed, fixes 408 1.1 kardel a problem with non-command-line specification of -6, and allows the loopback 409 1.1 kardel interface to share addresses with other interfaces. 410 1.1 kardel 411 1.1 kardel --- 412 1.1 kardel NTP 4.2.4p3 (Harlan Stenn <stenn (a] ntp.org>, 2007/06/29) 413 1.1 kardel 414 1.1 kardel Focus: Minor Bugfixes 415 1.1 kardel 416 1.1 kardel This release fixes a bug in Windows that made it difficult to 417 1.1 kardel terminate ntpd under windows. 418 1.1 kardel This is a recommended upgrade for Windows. 419 1.1 kardel 420 1.1 kardel --- 421 1.1 kardel NTP 4.2.4p2 (Harlan Stenn <stenn (a] ntp.org>, 2007/06/19) 422 1.1 kardel 423 1.1 kardel Focus: Minor Bugfixes 424 1.1 kardel 425 1.1 kardel This release fixes a multicast mode authentication problem, 426 1.1 kardel an error in NTP packet handling on Windows that could lead to 427 1.1 kardel ntpd crashing, and several other minor bugs. Handling of 428 1.1 kardel multicast interfaces and logging configuration were improved. 429 1.1 kardel The required versions of autogen and libopts were incremented. 430 1.1 kardel This is a recommended upgrade for Windows and multicast users. 431 1.1 kardel 432 1.1 kardel --- 433 1.1 kardel NTP 4.2.4 (Harlan Stenn <stenn (a] ntp.org>, 2006/12/31) 434 1.1 kardel 435 1.1 kardel Focus: enhancements and bug fixes. 436 1.1 kardel 437 1.1 kardel Dynamic interface rescanning was added to simplify the use of ntpd in 438 1.1 kardel conjunction with DHCP. GNU AutoGen is used for its command-line options 439 1.1 kardel processing. Separate PPS devices are supported for PARSE refclocks, MD5 440 1.1 kardel signatures are now provided for the release files. Drivers have been 441 1.1 kardel added for some new ref-clocks and have been removed for some older 442 1.1 kardel ref-clocks. This release also includes other improvements, documentation 443 1.1 kardel and bug fixes. 444 1.1 kardel 445 1.1 kardel K&R C is no longer supported as of NTP-4.2.4. We are now aiming for ANSI 446 1.1 kardel C support. 447 1.1 kardel 448 1.1 kardel --- 449 1.1 kardel NTP 4.2.0 (Harlan Stenn <stenn (a] ntp.org>, 2003/10/15) 450 1.1 kardel 451 1.1 kardel Focus: enhancements and bug fixes. 452
Indexes created Tue Apr 21 00:23:25 UTC 2026