NTP users are strongly urged to take immediate action to ensure that their NTP daemons are not susceptible to being used in distributed denial-of-service (DDoS) attacks. Please also take this opportunity to defeat denial-of-service attacks by implementing Ingress and Egress filtering through BCP38.

ntp-4.2.8p10 was released on 21 March 2017. It addresses 6 medium- and 5 low-severity security issues, 4 informational security topics, 15 bugfixes, and contains other improvements over 4.2.8p9.

Please see the NTP Security Notice for vulnerability and mitigation details.

---

Are you using Autokey in production? If so, please contact Harlan - he's got some questions for you.

NTP Bug 3383

NTP-01-008 NTP: Stack Buffer Overflow from Command Line (WINDOWS installer ONLY) (Low)

• Date Resolved: 21 Mar 2017
• References: Sec 3383 / CVE-2017-6452 / VU#325339
• Affects: WINDOWS installer ONLY: All versions of the ntp-4 Windows installer, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94.
• CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
• CVSS3: Low 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
• Summary: The Windows installer for NTP calls strcat(), blindly appending the string passed to the stack buffer in the addSourceToRegistry() function. The stack buffer is 70 bytes smaller than the buffer in the calling main() function. Together with the initially copied Registry path, the combination causes a stack buffer overflow and effectively overwrites the stack frame. The passed application path is actually limited to 256 bytes by the operating system, but this is not sufficient to assure that the affected stack buffer is consistently protected against overflowing at all times.
• Mitigation:
  • Upgrade to 4.2.8p10, or later, from the NTP Project Download Page or the NTP Public Services Project Download Page
• Credit: This weakness was discovered by Cure53.