NEWS revision 1.1.1.3.4.1
1 1.1.1.3 christos --- 2 1.1.1.3.4.1 riz NTP 4.2.8 (Harlan Stenn <stenn (a] ntp.org>, 2014/12/18) 3 1.1.1.3.4.1 riz 4 1.1.1.3.4.1 riz Focus: Security and Bug fixes, enhancements. 5 1.1.1.3.4.1 riz 6 1.1.1.3.4.1 riz Severity: HIGH 7 1.1.1.3.4.1 riz 8 1.1.1.3.4.1 riz In addition to bug fixes and enhancements, this release fixes the 9 1.1.1.3.4.1 riz following high-severity vulnerabilities: 10 1.1.1.3.4.1 riz 11 1.1.1.3.4.1 riz * Weak default key in config_auth(). 12 1.1.1.3.4.1 riz 13 1.1.1.3.4.1 riz References: [Sec 2665] / CVE-2014-9293 / VU#852879 14 1.1.1.3.4.1 riz CVSS: (AV:N/AC:L/Au:M/C:P/I:P/A:C) Base Score: 7.3 15 1.1.1.3.4.1 riz Vulnerable Versions: all releases prior to 4.2.7p11 16 1.1.1.3.4.1 riz Date Resolved: 28 Jan 2010 17 1.1.1.3.4.1 riz 18 1.1.1.3.4.1 riz Summary: If no 'auth' key is set in the configuration file, ntpd 19 1.1.1.3.4.1 riz would generate a random key on the fly. There were two 20 1.1.1.3.4.1 riz problems with this: 1) the generated key was 31 bits in size, 21 1.1.1.3.4.1 riz and 2) it used the (now weak) ntp_random() function, which was 22 1.1.1.3.4.1 riz seeded with a 32-bit value and could only provide 32 bits of 23 1.1.1.3.4.1 riz entropy. This was sufficient back in the late 1990s when the 24 1.1.1.3.4.1 riz code was written. Not today. 25 1.1.1.3.4.1 riz 26 1.1.1.3.4.1 riz Mitigation: Upgrade to 4.2.7p11 or later. 27 1.1.1.3.4.1 riz 28 1.1.1.3.4.1 riz Credit: This vulnerability was noticed in ntp-4.2.6 by Neel Mehta 29 1.1.1.3.4.1 riz of the Google Security Team. 30 1.1.1.3.4.1 riz 31 1.1.1.3.4.1 riz * Non-cryptographic random number generator with weak seed used by 32 1.1.1.3.4.1 riz ntp-keygen to generate symmetric keys. 33 1.1.1.3.4.1 riz 34 1.1.1.3.4.1 riz References: [Sec 2666] / CVE-2014-9294 / VU#852879 35 1.1.1.3.4.1 riz CVSS: (AV:N/AC:L/Au:M/C:P/I:P/A:C) Base Score: 7.3 36 1.1.1.3.4.1 riz Vulnerable Versions: All NTP4 releases before 4.2.7p230 37 1.1.1.3.4.1 riz Date Resolved: Dev (4.2.7p230) 01 Nov 2011 38 1.1.1.3.4.1 riz 39 1.1.1.3.4.1 riz Summary: Prior to ntp-4.2.7p230 ntp-keygen used a weak seed to 40 1.1.1.3.4.1 riz prepare a random number generator that was of good quality back 41 1.1.1.3.4.1 riz in the late 1990s. The random numbers produced was then used to 42 1.1.1.3.4.1 riz generate symmetric keys. In ntp-4.2.8 we use a current-technology 43 1.1.1.3.4.1 riz cryptographic random number generator, either RAND_bytes from 44 1.1.1.3.4.1 riz OpenSSL, or arc4random(). 45 1.1.1.3.4.1 riz 46 1.1.1.3.4.1 riz Mitigation: Upgrade to 4.2.7p230 or later. 47 1.1.1.3.4.1 riz 48 1.1.1.3.4.1 riz Credit: This vulnerability was discovered in ntp-4.2.6 by 49 1.1.1.3.4.1 riz Stephen Roettger of the Google Security Team. 50 1.1.1.3.4.1 riz 51 1.1.1.3.4.1 riz * Buffer overflow in crypto_recv() 52 1.1.1.3.4.1 riz 53 1.1.1.3.4.1 riz References: Sec 2667 / CVE-2014-9295 / VU#852879 54 1.1.1.3.4.1 riz CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5 55 1.1.1.3.4.1 riz Versions: All releases before 4.2.8 56 1.1.1.3.4.1 riz Date Resolved: Stable (4.2.8) 18 Dec 2014 57 1.1.1.3.4.1 riz 58 1.1.1.3.4.1 riz Summary: When Autokey Authentication is enabled (i.e. the ntp.conf 59 1.1.1.3.4.1 riz file contains a 'crypto pw ...' directive) a remote attacker 60 1.1.1.3.4.1 riz can send a carefully crafted packet that can overflow a stack 61 1.1.1.3.4.1 riz buffer and potentially allow malicious code to be executed 62 1.1.1.3.4.1 riz with the privilege level of the ntpd process. 63 1.1.1.3.4.1 riz 64 1.1.1.3.4.1 riz Mitigation: Upgrade to 4.2.8, or later, or 65 1.1.1.3.4.1 riz Disable Autokey Authentication by removing, or commenting out, 66 1.1.1.3.4.1 riz all configuration directives beginning with the crypto keyword 67 1.1.1.3.4.1 riz in your ntp.conf file. 68 1.1.1.3.4.1 riz 69 1.1.1.3.4.1 riz Credit: This vulnerability was discovered by Stephen Roettger of the 70 1.1.1.3.4.1 riz Google Security Team. 71 1.1.1.3.4.1 riz 72 1.1.1.3.4.1 riz * Buffer overflow in ctl_putdata() 73 1.1.1.3.4.1 riz 74 1.1.1.3.4.1 riz References: Sec 2668 / CVE-2014-9295 / VU#852879 75 1.1.1.3.4.1 riz CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5 76 1.1.1.3.4.1 riz Versions: All NTP4 releases before 4.2.8 77 1.1.1.3.4.1 riz Date Resolved: Stable (4.2.8) 18 Dec 2014 78 1.1.1.3.4.1 riz 79 1.1.1.3.4.1 riz Summary: A remote attacker can send a carefully crafted packet that 80 1.1.1.3.4.1 riz can overflow a stack buffer and potentially allow malicious 81 1.1.1.3.4.1 riz code to be executed with the privilege level of the ntpd process. 82 1.1.1.3.4.1 riz 83 1.1.1.3.4.1 riz Mitigation: Upgrade to 4.2.8, or later. 84 1.1.1.3.4.1 riz 85 1.1.1.3.4.1 riz Credit: This vulnerability was discovered by Stephen Roettger of the 86 1.1.1.3.4.1 riz Google Security Team. 87 1.1.1.3.4.1 riz 88 1.1.1.3.4.1 riz * Buffer overflow in configure() 89 1.1.1.3.4.1 riz 90 1.1.1.3.4.1 riz References: Sec 2669 / CVE-2014-9295 / VU#852879 91 1.1.1.3.4.1 riz CVSS: (AV:N/AC:L/Au:N/C:P/I:P/A:P) Base Score: 7.5 92 1.1.1.3.4.1 riz Versions: All NTP4 releases before 4.2.8 93 1.1.1.3.4.1 riz Date Resolved: Stable (4.2.8) 18 Dec 2014 94 1.1.1.3.4.1 riz 95 1.1.1.3.4.1 riz Summary: A remote attacker can send a carefully crafted packet that 96 1.1.1.3.4.1 riz can overflow a stack buffer and potentially allow malicious 97 1.1.1.3.4.1 riz code to be executed with the privilege level of the ntpd process. 98 1.1.1.3.4.1 riz 99 1.1.1.3.4.1 riz Mitigation: Upgrade to 4.2.8, or later. 100 1.1.1.3.4.1 riz 101 1.1.1.3.4.1 riz Credit: This vulnerability was discovered by Stephen Roettger of the 102 1.1.1.3.4.1 riz Google Security Team. 103 1.1.1.3.4.1 riz 104 1.1.1.3.4.1 riz * receive(): missing return on error 105 1.1.1.3.4.1 riz 106 1.1.1.3.4.1 riz References: Sec 2670 / CVE-2014-9296 / VU#852879 107 1.1.1.3.4.1 riz CVSS: (AV:N/AC:L/Au:N/C:N/I:N/A:P) Base Score: 5.0 108 1.1.1.3.4.1 riz Versions: All NTP4 releases before 4.2.8 109 1.1.1.3.4.1 riz Date Resolved: Stable (4.2.8) 18 Dec 2014 110 1.1.1.3.4.1 riz 111 1.1.1.3.4.1 riz Summary: Code in ntp_proto.c:receive() was missing a 'return;' in 112 1.1.1.3.4.1 riz the code path where an error was detected, which meant 113 1.1.1.3.4.1 riz processing did not stop when a specific rare error occurred. 114 1.1.1.3.4.1 riz We haven't found a way for this bug to affect system integrity. 115 1.1.1.3.4.1 riz If there is no way to affect system integrity the base CVSS 116 1.1.1.3.4.1 riz score for this bug is 0. If there is one avenue through which 117 1.1.1.3.4.1 riz system integrity can be partially affected, the base score 118 1.1.1.3.4.1 riz becomes a 5. If system integrity can be partially affected 119 1.1.1.3.4.1 riz via all three integrity metrics, the CVSS base score become 7.5. 120 1.1.1.3.4.1 riz 121 1.1.1.3.4.1 riz Mitigation: 122 1.1.1.3.4.1 riz Upgrade to 4.2.8, or later, 123 1.1.1.3.4.1 riz or Remove or comment out all configuration directives 124 1.1.1.3.4.1 riz beginning with the crypto keyword in your ntp.conf file. 125 1.1.1.3.4.1 riz 126 1.1.1.3.4.1 riz Credit: This vulnerability was discovered by Stephen Roettger of the 127 1.1.1.3.4.1 riz Google Security Team. 128 1.1.1.3.4.1 riz 129 1.1.1.3.4.1 riz See http://support.ntp.org/security for more information. 130 1.1.1.3.4.1 riz 131 1.1.1.3.4.1 riz New features / changes in this release: 132 1.1.1.3 christos 133 1.1.1.3 christos Important Changes 134 1.1.1.3 christos 135 1.1.1.3 christos * Internal NTP Era counters 136 1.1.1.3 christos 137 1.1.1.3.4.1 riz The internal counters that track the "era" (range of years) we are in 138 1.1.1.3 christos rolls over every 136 years'. The current "era" started at the stroke of 139 1.1.1.3 christos midnight on 1 Jan 1900, and ends just before the stroke of midnight on 140 1.1.1.3 christos 1 Jan 2036. 141 1.1.1.3 christos In the past, we have used the "midpoint" of the range to decide which 142 1.1.1.3 christos era we were in. Given the longevity of some products, it became clear 143 1.1.1.3 christos that it would be more functional to "look back" less, and "look forward" 144 1.1.1.3 christos more. We now compile a timestamp into the ntpd executable and when we 145 1.1.1.3 christos get a timestamp we us the "built-on" to tell us what era we are in. 146 1.1.1.3 christos This check "looks back" 10 years, and "looks forward" 126 years. 147 1.1.1.3 christos 148 1.1.1.3 christos * ntpdc responses disabled by default 149 1.1.1.3 christos 150 1.1.1.3 christos Dave Hart writes: 151 1.1.1.3 christos 152 1.1.1.3 christos For a long time, ntpq and its mostly text-based mode 6 (control) 153 1.1.1.3 christos protocol have been preferred over ntpdc and its mode 7 (private 154 1.1.1.3 christos request) protocol for runtime queries and configuration. There has 155 1.1.1.3 christos been a goal of deprecating ntpdc, previously held back by numerous 156 1.1.1.3 christos capabilities exposed by ntpdc with no ntpq equivalent. I have been 157 1.1.1.3 christos adding commands to ntpq to cover these cases, and I believe I've 158 1.1.1.3 christos covered them all, though I've not compared command-by-command 159 1.1.1.3 christos recently. 160 1.1.1.3 christos 161 1.1.1.3 christos As I've said previously, the binary mode 7 protocol involves a lot of 162 1.1.1.3 christos hand-rolled structure layout and byte-swapping code in both ntpd and 163 1.1.1.3 christos ntpdc which is hard to get right. As ntpd grows and changes, the 164 1.1.1.3 christos changes are difficult to expose via ntpdc while maintaining forward 165 1.1.1.3 christos and backward compatibility between ntpdc and ntpd. In contrast, 166 1.1.1.3 christos ntpq's text-based, label=value approach involves more code reuse and 167 1.1.1.3 christos allows compatible changes without extra work in most cases. 168 1.1.1.3 christos 169 1.1.1.3 christos Mode 7 has always been defined as vendor/implementation-specific while 170 1.1.1.3.4.1 riz mode 6 is described in RFC 1305 and intended to be open to interoperate 171 1.1.1.3 christos with other implementations. There is an early draft of an updated 172 1.1.1.3 christos mode 6 description that likely will join the other NTPv4 RFCs 173 1.1.1.3 christos eventually. (http://tools.ietf.org/html/draft-odonoghue-ntpv4-control-01) 174 1.1.1.3 christos 175 1.1.1.3 christos For these reasons, ntpd 4.2.7p230 by default disables processing of 176 1.1.1.3 christos ntpdc queries, reducing ntpd's attack surface and functionally 177 1.1.1.3 christos deprecating ntpdc. If you are in the habit of using ntpdc for certain 178 1.1.1.3 christos operations, please try the ntpq equivalent. If there's no equivalent, 179 1.1.1.3 christos please open a bug report at http://bugs.ntp.org./ 180 1.1.1.3 christos 181 1.1.1.3.4.1 riz In addition to the above, over 1100 issues have been resolved between 182 1.1.1.3.4.1 riz the 4.2.6 branch and 4.2.8. The ChangeLog file in the distribution 183 1.1.1.3.4.1 riz lists these. 184 1.1.1.3.4.1 riz 185 1.1.1.2 kardel --- 186 1.1.1.2 kardel NTP 4.2.6p5 (Harlan Stenn <stenn (a] ntp.org>, 2011/12/24) 187 1.1.1.2 kardel 188 1.1.1.2 kardel Focus: Bug fixes 189 1.1.1.2 kardel 190 1.1.1.2 kardel Severity: Medium 191 1.1.1.2 kardel 192 1.1.1.2 kardel This is a recommended upgrade. 193 1.1.1.2 kardel 194 1.1.1.2 kardel This release updates sys_rootdisp and sys_jitter calculations to match the 195 1.1.1.2 kardel RFC specification, fixes a potential IPv6 address matching error for the 196 1.1.1.2 kardel "nic" and "interface" configuration directives, suppresses the creation of 197 1.1.1.2 kardel extraneous ephemeral associations for certain broadcastclient and 198 1.1.1.2 kardel multicastclient configurations, cleans up some ntpq display issues, and 199 1.1.1.2 kardel includes improvements to orphan mode, minor bugs fixes and code clean-ups. 200 1.1.1.2 kardel 201 1.1.1.2 kardel New features / changes in this release: 202 1.1.1.2 kardel 203 1.1.1.2 kardel ntpd 204 1.1.1.2 kardel 205 1.1.1.2 kardel * Updated "nic" and "interface" IPv6 address handling to prevent 206 1.1.1.2 kardel mismatches with localhost [::1] and wildcard [::] which resulted from 207 1.1.1.2 kardel using the address/prefix format (e.g. fe80::/64) 208 1.1.1.2 kardel * Fix orphan mode stratum incorrectly counting to infinity 209 1.1.1.2 kardel * Orphan parent selection metric updated to includes missing ntohl() 210 1.1.1.2 kardel * Non-printable stratum 16 refid no longer sent to ntp 211 1.1.1.2 kardel * Duplicate ephemeral associations suppressed for broadcastclient and 212 1.1.1.2 kardel multicastclient without broadcastdelay 213 1.1.1.2 kardel * Exclude undetermined sys_refid from use in loopback TEST12 214 1.1.1.2 kardel * Exclude MODE_SERVER responses from KoD rate limiting 215 1.1.1.2 kardel * Include root delay in clock_update() sys_rootdisp calculations 216 1.1.1.2 kardel * get_systime() updated to exclude sys_residual offset (which only 217 1.1.1.2 kardel affected bits "below" sys_tick, the precision threshold) 218 1.1.1.2 kardel * sys.peer jitter weighting corrected in sys_jitter calculation 219 1.1.1.2 kardel 220 1.1.1.2 kardel ntpq 221 1.1.1.2 kardel 222 1.1.1.2 kardel * -n option extended to include the billboard "server" column 223 1.1.1.2 kardel * IPv6 addresses in the local column truncated to prevent overruns 224 1.1.1.2 kardel 225 1.1.1.2 kardel --- 226 1.1.1.2 kardel NTP 4.2.6p4 (Harlan Stenn <stenn (a] ntp.org>, 2011/09/22) 227 1.1.1.2 kardel 228 1.1.1.2 kardel Focus: Bug fixes and portability improvements 229 1.1.1.2 kardel 230 1.1.1.2 kardel Severity: Medium 231 1.1.1.2 kardel 232 1.1.1.2 kardel This is a recommended upgrade. 233 1.1.1.2 kardel 234 1.1.1.2 kardel This release includes build infrastructure updates, code 235 1.1.1.2 kardel clean-ups, minor bug fixes, fixes for a number of minor 236 1.1.1.2 kardel ref-clock issues, and documentation revisions. 237 1.1.1.2 kardel 238 1.1.1.2 kardel Portability improvements affect AIX, HP-UX, Linux, OS X and 64-bit time_t. 239 1.1.1.2 kardel 240 1.1.1.2 kardel New features / changes in this release: 241 1.1.1.2 kardel 242 1.1.1.2 kardel Build system 243 1.1.1.2 kardel 244 1.1.1.2 kardel * Fix checking for struct rtattr 245 1.1.1.2 kardel * Update config.guess and config.sub for AIX 246 1.1.1.2 kardel * Upgrade required version of autogen and libopts for building 247 1.1.1.2 kardel from our source code repository 248 1.1.1.2 kardel 249 1.1.1.2 kardel ntpd 250 1.1.1.2 kardel 251 1.1.1.2 kardel * Back-ported several fixes for Coverity warnings from ntp-dev 252 1.1.1.2 kardel * Fix a rare boundary condition in UNLINK_EXPR_SLIST() 253 1.1.1.2 kardel * Allow "logconfig =allall" configuration directive 254 1.1.1.2 kardel * Bind tentative IPv6 addresses on Linux 255 1.1.1.2 kardel * Correct WWVB/Spectracom driver to timestamp CR instead of LF 256 1.1.1.2 kardel * Improved tally bit handling to prevent incorrect ntpq peer status reports 257 1.1.1.2 kardel * Exclude the Undisciplined Local Clock and ACTS drivers from the initial 258 1.1.1.2 kardel candidate list unless they are designated a "prefer peer" 259 1.1.1.2 kardel * Prevent the consideration of Undisciplined Local Clock or ACTS drivers for 260 1.1.1.2 kardel selection during the 'tos orphanwait' period 261 1.1.1.2 kardel * Prefer an Orphan Mode Parent over the Undisciplined Local Clock or ACTS 262 1.1.1.2 kardel drivers 263 1.1.1.2 kardel * Improved support of the Parse Refclock trusttime flag in Meinberg mode 264 1.1.1.2 kardel * Back-port utility routines from ntp-dev: mprintf(), emalloc_zero() 265 1.1.1.2 kardel * Added the NTPD_TICKADJ_PPM environment variable for specifying baseline 266 1.1.1.2 kardel clock slew on Microsoft Windows 267 1.1.1.2 kardel * Code cleanup in libntpq 268 1.1.1.2 kardel 269 1.1.1.2 kardel ntpdc 270 1.1.1.2 kardel 271 1.1.1.2 kardel * Fix timerstats reporting 272 1.1.1.2 kardel 273 1.1.1.2 kardel ntpdate 274 1.1.1.2 kardel 275 1.1.1.2 kardel * Reduce time required to set clock 276 1.1.1.2 kardel * Allow a timeout greater than 2 seconds 277 1.1.1.2 kardel 278 1.1.1.2 kardel sntp 279 1.1.1.2 kardel 280 1.1.1.2 kardel * Backward incompatible command-line option change: 281 1.1.1.2 kardel -l/--filelog changed -l/--logfile (to be consistent with ntpd) 282 1.1.1.2 kardel 283 1.1.1.2 kardel Documentation 284 1.1.1.2 kardel 285 1.1.1.2 kardel * Update html2man. Fix some tags in the .html files 286 1.1.1.2 kardel * Distribute ntp-wait.html 287 1.1.1.2 kardel 288 1.1.1.2 kardel --- 289 1.1.1.2 kardel NTP 4.2.6p3 (Harlan Stenn <stenn (a] ntp.org>, 2011/01/03) 290 1.1.1.2 kardel 291 1.1.1.2 kardel Focus: Bug fixes and portability improvements 292 1.1.1.2 kardel 293 1.1.1.2 kardel Severity: Medium 294 1.1.1.2 kardel 295 1.1.1.2 kardel This is a recommended upgrade. 296 1.1.1.2 kardel 297 1.1.1.2 kardel This release includes build infrastructure updates, code 298 1.1.1.2 kardel clean-ups, minor bug fixes, fixes for a number of minor 299 1.1.1.2 kardel ref-clock issues, and documentation revisions. 300 1.1.1.2 kardel 301 1.1.1.2 kardel Portability improvements in this release affect AIX, Atari FreeMiNT, 302 1.1.1.2 kardel FreeBSD4, Linux and Microsoft Windows. 303 1.1.1.2 kardel 304 1.1.1.2 kardel New features / changes in this release: 305 1.1.1.2 kardel 306 1.1.1.2 kardel Build system 307 1.1.1.2 kardel * Use lsb_release to get information about Linux distributions. 308 1.1.1.2 kardel * 'test' is in /usr/bin (instead of /bin) on some systems. 309 1.1.1.2 kardel * Basic sanity checks for the ChangeLog file. 310 1.1.1.2 kardel * Source certain build files with ./filename for systems without . in PATH. 311 1.1.1.2 kardel * IRIX portability fix. 312 1.1.1.2 kardel * Use a single copy of the "libopts" code. 313 1.1.1.2 kardel * autogen/libopts upgrade. 314 1.1.1.2 kardel * configure.ac m4 quoting cleanup. 315 1.1.1.2 kardel 316 1.1.1.2 kardel ntpd 317 1.1.1.2 kardel * Do not bind to IN6_IFF_ANYCAST addresses. 318 1.1.1.2 kardel * Log the reason for exiting under Windows. 319 1.1.1.2 kardel * Multicast fixes for Windows. 320 1.1.1.2 kardel * Interpolation fixes for Windows. 321 1.1.1.2 kardel * IPv4 and IPv6 Multicast fixes. 322 1.1.1.2 kardel * Manycast solicitation fixes and general repairs. 323 1.1.1.2 kardel * JJY refclock cleanup. 324 1.1.1.2 kardel * NMEA refclock improvements. 325 1.1.1.2 kardel * Oncore debug message cleanup. 326 1.1.1.2 kardel * Palisade refclock now builds under Linux. 327 1.1.1.2 kardel * Give RAWDCF more baud rates. 328 1.1.1.2 kardel * Support Truetime Satellite clocks under Windows. 329 1.1.1.2 kardel * Support Arbiter 1093C Satellite clocks under Windows. 330 1.1.1.2 kardel * Make sure that the "filegen" configuration command defaults to "enable". 331 1.1.1.2 kardel * Range-check the status codes (plus other cleanup) in the RIPE-NCC driver. 332 1.1.1.2 kardel * Prohibit 'includefile' directive in remote configuration command. 333 1.1.1.2 kardel * Fix 'nic' interface bindings. 334 1.1.1.2 kardel * Fix the way we link with openssl if openssl is installed in the base 335 1.1.1.2 kardel system. 336 1.1.1.2 kardel 337 1.1.1.2 kardel ntp-keygen 338 1.1.1.2 kardel * Fix -V coredump. 339 1.1.1.2 kardel * OpenSSL version display cleanup. 340 1.1.1.2 kardel 341 1.1.1.2 kardel ntpdc 342 1.1.1.2 kardel * Many counters should be treated as unsigned. 343 1.1.1.2 kardel 344 1.1.1.2 kardel ntpdate 345 1.1.1.2 kardel * Do not ignore replies with equal receive and transmit timestamps. 346 1.1.1.2 kardel 347 1.1.1.2 kardel ntpq 348 1.1.1.2 kardel * libntpq warning cleanup. 349 1.1.1.2 kardel 350 1.1.1.2 kardel ntpsnmpd 351 1.1.1.2 kardel * Correct SNMP type for "precision" and "resolution". 352 1.1.1.2 kardel * Update the MIB from the draft version to RFC-5907. 353 1.1.1.2 kardel 354 1.1.1.2 kardel sntp 355 1.1.1.2 kardel * Display timezone offset when showing time for sntp in the local 356 1.1.1.2 kardel timezone. 357 1.1.1.2 kardel * Pay proper attention to RATE KoD packets. 358 1.1.1.2 kardel * Fix a miscalculation of the offset. 359 1.1.1.2 kardel * Properly parse empty lines in the key file. 360 1.1.1.2 kardel * Logging cleanup. 361 1.1.1.2 kardel * Use tv_usec correctly in set_time(). 362 1.1.1.2 kardel * Documentation cleanup. 363 1.1.1.2 kardel 364 1.1.1.2 kardel --- 365 1.1.1.2 kardel NTP 4.2.6p2 (Harlan Stenn <stenn (a] ntp.org>, 2010/07/08) 366 1.1.1.2 kardel 367 1.1.1.2 kardel Focus: Bug fixes and portability improvements 368 1.1.1.2 kardel 369 1.1.1.2 kardel Severity: Medium 370 1.1.1.2 kardel 371 1.1.1.2 kardel This is a recommended upgrade. 372 1.1.1.2 kardel 373 1.1.1.2 kardel This release includes build infrastructure updates, code 374 1.1.1.2 kardel clean-ups, minor bug fixes, fixes for a number of minor 375 1.1.1.2 kardel ref-clock issues, improved KOD handling, OpenSSL related 376 1.1.1.2 kardel updates and documentation revisions. 377 1.1.1.2 kardel 378 1.1.1.2 kardel Portability improvements in this release affect Irix, Linux, 379 1.1.1.2 kardel Mac OS, Microsoft Windows, OpenBSD and QNX6 380 1.1.1.2 kardel 381 1.1.1.2 kardel New features / changes in this release: 382 1.1.1.2 kardel 383 1.1.1.2 kardel ntpd 384 1.1.1.2 kardel * Range syntax for the trustedkey configuration directive 385 1.1.1.2 kardel * Unified IPv4 and IPv6 restrict lists 386 1.1.1.2 kardel 387 1.1.1.2 kardel ntpdate 388 1.1.1.2 kardel * Rate limiting and KOD handling 389 1.1.1.2 kardel 390 1.1.1.2 kardel ntpsnmpd 391 1.1.1.2 kardel * default connection to net-snmpd via a unix-domain socket 392 1.1.1.2 kardel * command-line 'socket name' option 393 1.1.1.2 kardel 394 1.1.1.2 kardel ntpq / ntpdc 395 1.1.1.2 kardel * support for the "passwd ..." syntax 396 1.1.1.2 kardel * key-type specific password prompts 397 1.1.1.2 kardel 398 1.1.1.2 kardel sntp 399 1.1.1.2 kardel * MD5 authentication of an ntpd 400 1.1.1.2 kardel * Broadcast and crypto 401 1.1.1.2 kardel * OpenSSL support 402 1.1.1.2 kardel 403 1.1.1.2 kardel --- 404 1.1.1.2 kardel NTP 4.2.6p1 (Harlan Stenn <stenn (a] ntp.org>, 2010/04/09) 405 1.1.1.2 kardel 406 1.1.1.2 kardel Focus: Bug fixes, portability fixes, and documentation improvements 407 1.1.1.2 kardel 408 1.1.1.2 kardel Severity: Medium 409 1.1.1.2 kardel 410 1.1.1.2 kardel This is a recommended upgrade. 411 1.1.1.2 kardel 412 1.1.1.2 kardel --- 413 1.1.1.2 kardel NTP 4.2.6 (Harlan Stenn <stenn (a] ntp.org>, 2009/12/08) 414 1.1.1.2 kardel 415 1.1.1.2 kardel Focus: enhancements and bug fixes. 416 1.1.1.2 kardel 417 1.1.1.2 kardel --- 418 1.1 kardel NTP 4.2.4p8 (Harlan Stenn <stenn (a] ntp.org>, 2009/12/08) 419 1.1 kardel 420 1.1 kardel Focus: Security Fixes 421 1.1 kardel 422 1.1 kardel Severity: HIGH 423 1.1 kardel 424 1.1 kardel This release fixes the following high-severity vulnerability: 425 1.1 kardel 426 1.1 kardel * [Sec 1331] DoS with mode 7 packets - CVE-2009-3563. 427 1.1 kardel 428 1.1 kardel See http://support.ntp.org/security for more information. 429 1.1 kardel 430 1.1 kardel NTP mode 7 (MODE_PRIVATE) is used by the ntpdc query and control utility. 431 1.1 kardel In contrast, ntpq uses NTP mode 6 (MODE_CONTROL), while routine NTP time 432 1.1 kardel transfers use modes 1 through 5. Upon receipt of an incorrect mode 7 433 1.1 kardel request or a mode 7 error response from an address which is not listed 434 1.1 kardel in a "restrict ... noquery" or "restrict ... ignore" statement, ntpd will 435 1.1 kardel reply with a mode 7 error response (and log a message). In this case: 436 1.1 kardel 437 1.1 kardel * If an attacker spoofs the source address of ntpd host A in a 438 1.1 kardel mode 7 response packet sent to ntpd host B, both A and B will 439 1.1 kardel continuously send each other error responses, for as long as 440 1.1 kardel those packets get through. 441 1.1 kardel 442 1.1 kardel * If an attacker spoofs an address of ntpd host A in a mode 7 443 1.1 kardel response packet sent to ntpd host A, A will respond to itself 444 1.1 kardel endlessly, consuming CPU and logging excessively. 445 1.1 kardel 446 1.1 kardel Credit for finding this vulnerability goes to Robin Park and Dmitri 447 1.1 kardel Vinokurov of Alcatel-Lucent. 448 1.1 kardel 449 1.1 kardel THIS IS A STRONGLY RECOMMENDED UPGRADE. 450 1.1 kardel 451 1.1 kardel --- 452 1.1 kardel ntpd now syncs to refclocks right away. 453 1.1 kardel 454 1.1.1.2 kardel Backward-Incompatible changes: 455 1.1 kardel 456 1.1 kardel ntpd no longer accepts '-v name' or '-V name' to define internal variables. 457 1.1 kardel Use '--var name' or '--dvar name' instead. (Bug 817) 458 1.1 kardel 459 1.1 kardel --- 460 1.1 kardel NTP 4.2.4p7 (Harlan Stenn <stenn (a] ntp.org>, 2009/05/04) 461 1.1 kardel 462 1.1 kardel Focus: Security and Bug Fixes 463 1.1 kardel 464 1.1 kardel Severity: HIGH 465 1.1 kardel 466 1.1 kardel This release fixes the following high-severity vulnerability: 467 1.1 kardel 468 1.1 kardel * [Sec 1151] Remote exploit if autokey is enabled. CVE-2009-1252 469 1.1 kardel 470 1.1 kardel See http://support.ntp.org/security for more information. 471 1.1 kardel 472 1.1 kardel If autokey is enabled (if ntp.conf contains a "crypto pw whatever" 473 1.1 kardel line) then a carefully crafted packet sent to the machine will cause 474 1.1 kardel a buffer overflow and possible execution of injected code, running 475 1.1 kardel with the privileges of the ntpd process (often root). 476 1.1 kardel 477 1.1 kardel Credit for finding this vulnerability goes to Chris Ries of CMU. 478 1.1 kardel 479 1.1 kardel This release fixes the following low-severity vulnerabilities: 480 1.1 kardel 481 1.1 kardel * [Sec 1144] limited (two byte) buffer overflow in ntpq. CVE-2009-0159 482 1.1 kardel Credit for finding this vulnerability goes to Geoff Keating of Apple. 483 1.1 kardel 484 1.1 kardel * [Sec 1149] use SO_EXCLUSIVEADDRUSE on Windows 485 1.1 kardel Credit for finding this issue goes to Dave Hart. 486 1.1 kardel 487 1.1 kardel This release fixes a number of bugs and adds some improvements: 488 1.1 kardel 489 1.1 kardel * Improved logging 490 1.1 kardel * Fix many compiler warnings 491 1.1 kardel * Many fixes and improvements for Windows 492 1.1 kardel * Adds support for AIX 6.1 493 1.1 kardel * Resolves some issues under MacOS X and Solaris 494 1.1 kardel 495 1.1 kardel THIS IS A STRONGLY RECOMMENDED UPGRADE. 496 1.1 kardel 497 1.1 kardel --- 498 1.1 kardel NTP 4.2.4p6 (Harlan Stenn <stenn (a] ntp.org>, 2009/01/07) 499 1.1 kardel 500 1.1 kardel Focus: Security Fix 501 1.1 kardel 502 1.1 kardel Severity: Low 503 1.1 kardel 504 1.1 kardel This release fixes oCERT.org's CVE-2009-0021, a vulnerability affecting 505 1.1 kardel the OpenSSL library relating to the incorrect checking of the return 506 1.1 kardel value of EVP_VerifyFinal function. 507 1.1 kardel 508 1.1 kardel Credit for finding this issue goes to the Google Security Team for 509 1.1 kardel finding the original issue with OpenSSL, and to ocert.org for finding 510 1.1 kardel the problem in NTP and telling us about it. 511 1.1 kardel 512 1.1 kardel This is a recommended upgrade. 513 1.1 kardel --- 514 1.1 kardel NTP 4.2.4p5 (Harlan Stenn <stenn (a] ntp.org>, 2008/08/17) 515 1.1 kardel 516 1.1 kardel Focus: Minor Bugfixes 517 1.1 kardel 518 1.1 kardel This release fixes a number of Windows-specific ntpd bugs and 519 1.1 kardel platform-independent ntpdate bugs. A logging bugfix has been applied 520 1.1 kardel to the ONCORE driver. 521 1.1 kardel 522 1.1 kardel The "dynamic" keyword and is now obsolete and deferred binding to local 523 1.1 kardel interfaces is the new default. The minimum time restriction for the 524 1.1 kardel interface update interval has been dropped. 525 1.1 kardel 526 1.1 kardel A number of minor build system and documentation fixes are included. 527 1.1 kardel 528 1.1 kardel This is a recommended upgrade for Windows. 529 1.1 kardel 530 1.1 kardel --- 531 1.1 kardel NTP 4.2.4p4 (Harlan Stenn <stenn (a] ntp.org>, 2007/09/10) 532 1.1 kardel 533 1.1 kardel Focus: Minor Bugfixes 534 1.1 kardel 535 1.1 kardel This release updates certain copyright information, fixes several display 536 1.1 kardel bugs in ntpdc, avoids SIGIO interrupting malloc(), cleans up file descriptor 537 1.1 kardel shutdown in the parse refclock driver, removes some lint from the code, 538 1.1 kardel stops accessing certain buffers immediately after they were freed, fixes 539 1.1 kardel a problem with non-command-line specification of -6, and allows the loopback 540 1.1 kardel interface to share addresses with other interfaces. 541 1.1 kardel 542 1.1 kardel --- 543 1.1 kardel NTP 4.2.4p3 (Harlan Stenn <stenn (a] ntp.org>, 2007/06/29) 544 1.1 kardel 545 1.1 kardel Focus: Minor Bugfixes 546 1.1 kardel 547 1.1 kardel This release fixes a bug in Windows that made it difficult to 548 1.1 kardel terminate ntpd under windows. 549 1.1 kardel This is a recommended upgrade for Windows. 550 1.1 kardel 551 1.1 kardel --- 552 1.1 kardel NTP 4.2.4p2 (Harlan Stenn <stenn (a] ntp.org>, 2007/06/19) 553 1.1 kardel 554 1.1 kardel Focus: Minor Bugfixes 555 1.1 kardel 556 1.1 kardel This release fixes a multicast mode authentication problem, 557 1.1 kardel an error in NTP packet handling on Windows that could lead to 558 1.1 kardel ntpd crashing, and several other minor bugs. Handling of 559 1.1 kardel multicast interfaces and logging configuration were improved. 560 1.1 kardel The required versions of autogen and libopts were incremented. 561 1.1 kardel This is a recommended upgrade for Windows and multicast users. 562 1.1 kardel 563 1.1 kardel --- 564 1.1 kardel NTP 4.2.4 (Harlan Stenn <stenn (a] ntp.org>, 2006/12/31) 565 1.1 kardel 566 1.1 kardel Focus: enhancements and bug fixes. 567 1.1 kardel 568 1.1 kardel Dynamic interface rescanning was added to simplify the use of ntpd in 569 1.1 kardel conjunction with DHCP. GNU AutoGen is used for its command-line options 570 1.1 kardel processing. Separate PPS devices are supported for PARSE refclocks, MD5 571 1.1 kardel signatures are now provided for the release files. Drivers have been 572 1.1 kardel added for some new ref-clocks and have been removed for some older 573 1.1 kardel ref-clocks. This release also includes other improvements, documentation 574 1.1 kardel and bug fixes. 575 1.1 kardel 576 1.1 kardel K&R C is no longer supported as of NTP-4.2.4. We are now aiming for ANSI 577 1.1 kardel C support. 578 1.1 kardel 579 1.1 kardel --- 580 1.1 kardel NTP 4.2.0 (Harlan Stenn <stenn (a] ntp.org>, 2003/10/15) 581 1.1 kardel 582 1.1 kardel Focus: enhancements and bug fixes. 583
Indexes created Mon Apr 20 00:23:12 UTC 2026