# MA-437.122014: MyCERT Advisory - Vulnerabilities Identified in Network Time Protocol Daemon

**Date:** 23 Dec 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-437.122014  
**Advisory ID:** MA-437.122014

---

#### **1.0     Introduction**
NTP has released an update that addresses multiple vulnerabilities in the Network Time Protocol daemon. Exploitation of these vulnerabilities may allow a remote attacker to execute malicious code.
**2.0     Impact**
These updates address buffer overflow vulnerabilities in ntpd that may allow a remote unauthenticated attacker to execute arbitrary malicious code with the privilege level of the ntpd process.
While the weak default key and non-cryptographic random number generator in ntp-keygen may allow an attacker to gain information regarding the integrity checking and authentication encryption schemes
**3.0 Affected Products**
List of affected products:
- ntpd version 4.2.7 and previous versions
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
- The current version of NTP product 4.2.8 can be downloaded at:
<http://www.ntp.org/downloads.html>
- Detail information about what is NTP, please refer MyCERT Technical Notes:
[https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=51847bdf-9753-4835-8957-385ebc8b7971](https://www.mycert.org.my/portal/articles-content?menu=4b05e0fb-afa1-408f-90ca-ea0edf4aca8b&id=51847bdf-9753-4835-8957-385ebc8b7971
)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
- Vulnerabilities Identified in Network Time Protocol Daemon;
<https://www.us-cert.gov/ncas/current-activity/2014/12/19/Vulnerabilities-Identified-Network-Time-Protocol-Daemon>
- Vulnerability Note VU#852879;
<http://www.kb.cert.org/vuls/id/852879>
- NTP 4.28;
<http://www.ntp.org/downloads.html>