Strange NTP error

X

xy16644

I've just tried to update all my ports and when I list the outdated ports with portmaster -L I get:

Code: 
===>>> ntp-4.2.6p5_2
===>>> This port is marked FORBIDDEN
===>>> CVE-2013-5211 / VU

Even after updating all my ports I still have this warning. I did have a look in /usr/src/UPDATING but couldn't find anything on NTP.

Any ideas?
 
I just read the FreeBSD Security Advisory regarding this. I wonder if NTP in FreeBSD 10 STABLE will be fixed?
 
Thanks for your prompt reply. :)

However, I have got the following warning from pkg audit -F.
Code: 
Vulnxml file up-to-date.
ntp-4.2.6p5_2 is vulnerable:
ntpd DRDoS / Amplification Attack using ntpdc monlist command
CVE: CVE-2013-5211
WWW: http://portaudit.FreeBSD.org/3d95c9a7-7d5c-11e3-a8c1-206a8a720317.html

How can I get rid of it? Thanks in advance!
 
In case you're interested in the NTP client, you can try ntp-devel, i had to do that on a very fresh 10 install:
Code: 
portmaster net/ntp-devel
 
Is this issue related to the fact that NTP 4.2.7p26 is a development release and not a production release of the NTP daemon? It's just that we are getting quite a number of customers conducting security scans on our GPS NTP servers which is reporting NTP 4.2.6 as being an old version of NTPd, which is susceptible to the monlist denial of service attack, and needs to be updated to NTP 4.2.7. However, we are very reluctant to provide an update to NTP 4.2.7 when it is not a stable production version of the NTP protocol.

Everett
http://www.timetoolsglobal.com/
 
aevertett said:
Is this issue related to the fact that NTP 4.2.7p26 is a development release and not a production release of the NTP daemon?
Click to expand...
No, it's related to a security issue:
http://networktimefoundation.org/ntp-wi ... s-attacks/

It's just that we are getting quite a number of customers conducting security scans on our GPS NTP servers which is reporting NTP 4.2.6 as being an old version of NTPd, which is susceptible to the monlist denial of service attack, and needs to be updated to NTP 4.2.7. However, we are very reluctant to provide an update to NTP 4.2.7 when it is not a stable production version of the NTP protocol.
Click to expand...
I'm afraid you don't have much choice, although you may be able to turn off the monitoring option:
http://support.ntp.org/bin/view/Main/Se ... tack_using
 
Current versions of FreeBSD base and ports are all fixed, AFAIK. If the security scan only checks the version number, the NTP in base might show a false positive because the version number has not changed even though the bug was fixed. monlist can also be manually disabled.

(That a security tool would check just a version number seems... well, "too trusting" is not quite the right thing to say. "Gullible" might be more accurate. But a lot of these tools do that, apparently.)
 
You must log in or register to reply here.
Back
Top