This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

NTP vulnerability

Several vulnerabilities in NTP were revealed today, just in time for everyone to be away on vacation!

https://ics-cert.us-cert.gov/advisories/ICSA-14-353-01

Can we expect a hotfix for this?

This thread was automatically locked due to age.

0 Scott_Klassen over 10 years ago

Can we expect a hotfix for this?
UTM doesn't have hotfixes. There will be an Up2Date with a fix at some point, when possible.

__________________
ACE v8/SCA v9.3

...still have a v5 install disk in a box somewhere.

http://xkcd.com
http://www.tedgoff.com/mb
http://www.projectcartoon.com/cartoon/1
Cancel
Vote Up 0 Vote Down

Cancel
0 SmallAdmin over 10 years ago

NTP access is limited to pool.ntp.org in most setups. So the attacker would first have to hack one of those servers in the pool in order to exploit it. Besides that, ntpd normally has very limited permissions. Still, it should be patched ASAP!
Cancel
Vote Up 0 Vote Down

Cancel
0 aimeedev over 10 years ago

Interesting, Apple and Ubuntu have released patch, esp surprising for Apple to respond so quickly
Cancel
Vote Up 0 Vote Down

Cancel
0 RFCat_vk_01 over 10 years ago in reply to aimeedev

If you read the release, the issue was fixed in January 2010 release. Depends on which version Sophos are using whether they need to patch or not.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 aimeedev over 10 years ago

ps shows a /sbin/ntpd running, but its not there.

Other ntp tools all show Ver. 4.2.6p5

Cert states...

Products using NTP service prior to NTP-4.2.8 are affected. No specific vendor is specified because this is an open source protocol.

Am I missing something?

UTM 9.210-20
Cancel
Vote Up 0 Vote Down

Cancel