Wind River Support Network

HomeDefectsLIN7-4998
Fixed

LIN7-4998 : Security Advisory - ntp - CVE-2015-7701

Created: Oct 22, 2015    Updated: Sep 8, 2018
Resolved Date: Nov 6, 2015
Previous ID: LIN4-33117
Found In Version: 7.0.0.9
Fix Version: 7.0.0.12
Severity: Standard
Applicable for: Wind River Linux 7
Component/s: Userspace

Description

A memory leak flaw was found in ntpd's CRYPTO_ASSOC. If ntpd is configured to use autokey authentication, an attacker could send packets to ntpd that would, after several days of ongoing attack, cause it to run out of memory.

Mitigation:

Disable NTP autokey authentication.

External References:

https://github.com/ntp-project/ntp/blob/stable/NEWS#L91
http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7701

Other Downloads


CVEs


Live chat
Online