The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:2024 advisory.

    The Network Time Protocol (NTP) is used to synchronize a computer's time     with a referenced time source.

    Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(),     ctl_putdata(), and configure() functions. A remote attacker could use     either of these flaws to send a specially crafted request packet that could     crash ntpd or, potentially, execute arbitrary code with the privileges of     the ntp user. Note: the crypto_recv() flaw requires non-default     configurations to be active, while the ctl_putdata() flaw, by default, can     only be exploited via local attackers, and the configure() flaw requires     additional authentication to exploit. (CVE-2014-9295)

    It was found that ntpd automatically generated weak keys for its internal     use if no ntpdc request authentication key was specified in the ntp.conf     configuration file. A remote attacker able to match the configured IP     restrictions could guess the generated key, and possibly use it to send     ntpdc query or configuration requests. (CVE-2014-9293)

    It was found that ntp-keygen used a weak method for generating MD5 keys.
    This could possibly allow an attacker to guess generated MD5 keys that     could then be used to spoof an NTP client or server. Note: it is     recommended to regenerate any MD5 keys that had explicitly been generated     with ntp-keygen; the default installation does not contain such keys).
    (CVE-2014-9294)

    A missing return statement in the receive() function could potentially     allow a remote attacker to bypass NTP's authentication mechanism.
    (CVE-2014-9296)

    All ntp users are advised to upgrade to this updated package, which     contains backported patches to resolve these issues. After installing the     update, the ntpd daemon will restart automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 / 7 : ntp (RHSA-2014:2024)

medium Nessus Plugin ID 80160

Version 1.24