---
NTP 4.2.8p15 (Harlan Stenn <stenn@ntp.org>, 2020 Jun 23)

Focus: Security, Bug fixes

Severity: MEDIUM

This release fixes one vulnerability: Associations that use CMAC
authentication between ntpd from versions 4.2.8p11/4.3.97 and
4.2.8p14/4.3.100 will leak a small amount of memory for each packet.
Eventually, ntpd will run out of memory and abort.

It also fixes 13 other bugs.

* [Sec 3661] memory leak with AES128CMAC keys <perlinger@ntp.org>
* [Bug 3670] Regression from bad merger between 3592 and 3596 <perlinger@>
  - Thanks to Sylar Tao
* [Bug 3667] decodenetnum fails with numeric port <perlinger@ntp.org>
  - rewrite 'decodenetnum()' in terms of inet_pton
* [Bug 3666] avoid unlimited receive buffer allocation <perlinger@ntp.org>
  - limit number of receive buffers, with an iron reserve for refclocks
* [Bug 3664] Enable openSSL CMAC support on Windows <burnicki@ntp.org>
* [Bug 3662] Fix build errors on Windows with VS2008 <burnicki@ntp.org>
* [Bug 3660] Manycast orphan mode startup discovery problem. <stenn@ntp.org>
  - integrated patch from Charles Claggett
* [Bug 3659] Move definition of psl[] from ntp_config.h to
  ntp_config.h <perlinger@ntp.org>
* [Bug 3657] Wrong "Autokey group mismatch" debug message <perlinger@ntp.org>
* [Bug 3655] ntpdc memstats hash counts <perlinger@ntp.org>
  - fix by Gerry garvey
* [Bug 3653] Refclock jitter RMS calculation <perlinger@ntp.org>
  - thanks to Gerry Garvey
* [Bug 3646] Avoid sync with unsync orphan <perlinger@ntp.org>
  - patch by Gerry Garvey
* [Bug 3644] Unsynchronized server [...] selected as candidate <perlinger@ntp.org>
* [Bug 3639] refclock_jjy: TS-JJY0x can skip time sync depending on the STUS reply. <abe@ntp.org>
  - applied patch by Takao Abe

---
NTP 4.2.8p14 (Harlan Stenn <stenn@ntp.org>, 2020 Mar 03)

Focus: Security, Bug fixes, enhancements.

Severity: MEDIUM

This release fixes three vulnerabilities: a bug that causes causes an ntpd
instance that is explicitly configured to override the default and allow
ntpdc (mode 7) connections to be made to a server to read some uninitialized
memory; fixes the case where an unmonitored ntpd using an unauthenticated
association to its servers may be susceptible to a forged packet DoS attack;
and fixes an attack against a client instance that uses a single
unauthenticated time source.  It also fixes 46 other bugs and addresses
4 other issues.

* [Sec 3610] process_control() should bail earlier on short packets. stenn@
  - Reported by Philippe Antoine
* [Sec 3596] Highly predictable timestamp attack. <stenn@ntp.org>
  - Reported by Miroslav Lichvar
* [Sec 3592] DoS attack on client ntpd <perlinger@ntp.org>
  - Reported by Miroslav Lichvar
* [Bug 3637] Emit the version of ntpd in saveconfig.  stenn@
* [Bug 3636] NMEA: combine time/date from multiple sentences <perlinger@ntp.org>
* [Bug 3635] Make leapsecond file hash check optional <perlinger@ntp.org>
* [Bug 3634] Typo in discipline.html, reported by Jason Harrison.  stenn@
* [Bug 3628] raw DCF decoding - improve robustness with Zeller's congruence
  - implement Zeller's congruence in libparse and libntp <perlinger@ntp.org>
* [Bug 3627] SIGSEGV on FreeBSD-12 with stack limit and stack gap <perlinger@ntp.org>
  - integrated patch by Cy Schubert
* [Bug 3620] memory leak in ntpq sysinfo <perlinger@ntp.org>
  - applied patch by Gerry Garvey
* [Bug 3619] Honour drefid setting in cooked mode and sysinfo <perlinger@ntp.org>
  - applied patch by Gerry Garvey
* [Bug 3617] Add support for ACE III and Copernicus II receivers <perlinger@ntp.org>
  - integrated patch by Richard Steedman
* [Bug 3615] accelerate refclock startup <perlinger@ntp.org>
* [Bug 3613] Propagate noselect to mobilized pool servers <stenn@ntp.org>
  - Reported by Martin Burnicki
* [Bug 3612] Use-of-uninitialized-value in receive function <perlinger@ntp.org>
  - Reported by Philippe Antoine
* [Bug 3611] NMEA time interpreted incorrectly <perlinger@ntp.org>
  - officially document new "trust date" mode bit for NMEA driver
  - restore the (previously undocumented) "trust date" feature lost with [bug 3577] 
* [Bug 3609] Fixing wrong falseticker in case of non-statistic jitter <perlinger@ntp.org>
  - mostly based on a patch by Michael Haardt, implementing 'fudge minjitter'
* [Bug 3608] libparse fails to compile on S11.4SRU13 and later <perlinger@ntp.org>
  - removed ffs() and fls() prototypes as per Brian Utterback
* [Bug 3604] Wrong param byte order passing into record_raw_stats() in
	ntp_io.c <perlinger@ntp.org>
  - fixed byte and paramter order as suggested by wei6410@sina.com 
* [Bug 3601] Tests fail to link on platforms with ntp_cv_gc_sections_runs=no <perlinger@ntp.org>
* [Bug 3599] Build fails on linux-m68k due to alignment issues <perlinger@ntp.org>
  - added padding as suggested by John Paul Adrian Glaubitz 
* [Bug 3594] ntpd discards messages coming through nmead <perlinger@ntp.org>
* [Bug 3593] ntpd discards silently nmea messages after the 5th string <perlinger@ntp.org>
* [Bug 3590] Update refclock_oncore.c to the new GPS date API <perlinger@ntp.org>
* [Bug 3585] Unity tests mix buffered and unbuffered output <perlinger@ntp.org>
  - stdout+stderr are set to line buffered during test setup now
* [Bug 3583] synchronization error <perlinger@ntp.org>
  - set clock to base date if system time is before that limit
* [Bug 3582] gpsdjson refclock fudgetime1 adjustment is doubled <perlinger@ntp.org>
* [Bug 3580] Possible bug ntpq-subs (NULL dereference in dogetassoc) <perlinger@ntp.org>
  - Reported by Paulo Neves
* [Bug 3577] Update refclock_zyfer.c to the new GPS date API <perlinger@ntp.org>
  - also updates for refclock_nmea.c and refclock_jupiter.c
* [Bug 3576] New GPS date function API <perlinger@ntp.org>
* [Bug 3573] nptdate: missleading error message <perlinger@ntp.org>
* [Bug 3570] NMEA driver docs: talker ID not mentioned, typo <perlinger@ntp.org>
* [Bug 3569] cleanup MOD_NANO/STA_NANO handling for 'ntpadjtimex()' <perlinger@ntp.org>
  - sidekick: service port resolution in 'ntpdate'
* [Bug 3550] Reproducible build: Respect SOURCE_DATE_EPOCH <perlinger@ntp.org>
  - applied patch by Douglas Royds
* [Bug 3542] ntpdc monlist parameters cannot be set <perlinger@ntp.org>
* [Bug 3533] ntpdc peer_info ipv6 issues <perlinger@ntp.org>
  - applied patch by Gerry Garvey
* [Bug 3531] make check: test-decodenetnum fails <perlinger@ntp.org>
  - try to harden 'decodenetnum()' against 'getaddrinfo()' errors
  - fix wrong cond-compile tests in unit tests
* [Bug 3517] Reducing build noise <perlinger@ntp.org>
* [Bug 3516] Require tooling from this decade <perlinger@ntp.org>
  - patch by Philipp Prindeville
* [Bug 3515] Refactor ntpdmain() dispatcher loop and group common code <perlinger@ntp.org>
  - patch by Philipp Prindeville
* [Bug 3511] Get rid of AC_LANG_SOURCE() warnings <perlinger@ntp.org>
  - patch by Philipp Prindeville
* [Bug 3510] Flatten out the #ifdef nesting in ntpdmain() <perlinger@ntp.org>
  - partial application of patch by Philipp Prindeville
* [Bug 3491] Signed values of LFP datatypes should always display a sign
  - applied patch by Gerry Garvey & fixed unit tests <perlinger@ntp.org>
* [Bug 3490] Patch to support Trimble Resolution Receivers <perlinger@ntp.org>
  - applied (modified) patch by Richard Steedman
* [Bug 3473] RefID of refclocks should always be text format <perlinger@ntp.org>
  - applied patch by Gerry Garvey (with minor formatting changes)
* [Bug 3132] Building 4.2.8p8 with disabled local libopts fails <perlinger@ntp.org>
  - applied patch by Miroslav Lichvar
* [Bug 3094] ntpd trying to listen for broadcasts on a completely ipv6 network
  <perlinger@ntp.org>
* [Bug 2420] ntpd doesn't run and exits with retval 0 when invalid user
             is specified with -u <perlinger@ntp.org>
  - monitor daemon child startup & propagate exit codes
* [Bug 1433] runtime check whether the kernel really supports capabilities
  - (modified) patch by Kurt Roeckx <perlinger@ntp.org>
* Clean up sntp/networking.c:sendpkt() error message.  <stenn@ntp.org>
* Provide more detail on unrecognized config file parser tokens. <stenn@ntp.org>
* Startup log improvements. <stenn@ntp.org>
* Update the copyright year.

---
NTP 4.2.8p13 (Harlan Stenn <stenn@ntp.org>, 2019 Mar 07)

Focus: Security, Bug fixes, enhancements.

Severity: MEDIUM

This release fixes a bug that allows an attacker with access to an
explicitly trusted source to send a crafted malicious mode 6 (ntpq)
packet that can trigger a NULL pointer dereference, crashing ntpd.
It also provides 17 other bugfixes and 1 other improvement:

* [Sec 3565] Crafted null dereference attack in authenticated
	     mode 6 packet <perlinger@ntp.org>
  - reported by Magnus Stubman
* [Bug 3560] Fix build when HAVE_DROPROOT is not defined <perlinger@ntp.org>
  - applied patch by Ian Lepore
* [Bug 3558] Crash and integer size bug <perlinger@ntp.org>
  - isolate and fix linux/windows specific code issue
* [Bug 3556] ntp_loopfilter.c snprintf compilation warnings <perlinger@ntp.org>
  - provide better function for incremental string formatting
* [Bug 3555] Tidy up print alignment of debug output from ntpdate <perlinger@ntp.org>
  - applied patch by Gerry Garvey
* [Bug 3554] config revoke stores incorrect value <perlinger@ntp.org>
  - original finding by Gerry Garvey, additional cleanup needed
* [Bug 3549] Spurious initgroups() error message <perlinger@ntp.org>
  - patch by Christous Zoulas
* [Bug 3548] Signature not verified on windows system <perlinger@ntp.org>
  - finding by Chen Jiabin, plus another one by me
* [Bug 3541] patch to fix STA_NANO struct timex units <perlinger@ntp.org>
  - applied patch by Maciej Szmigiero
* [Bug 3540] Cannot set minsane to 0 anymore <perlinger@ntp.org>
  - applied patch by Andre Charbonneau
* [Bug 3539] work_fork build fails when droproot is not supported <perlinger@ntp.org>
  - applied patch by Baruch Siach
* [Bug 3538] Build fails for no-MMU targets <perlinger@ntp.org>
  - applied patch by Baruch Siach
* [Bug 3535] libparse won't handle GPS week rollover <perlinger@ntp.org>
  - refactored handling of GPS era based on 'tos basedate' for
    parse (TSIP) and JUPITER clocks
* [Bug 3529] Build failures on Mac OS X 10.13 (High Sierra) <perlinger@ntp.org>
  - patch by Daniel J. Luke; this does not fix a potential linker
    regression issue on MacOS.
* [Bug 3527 - Backward Incompatible] mode7 clockinfo fudgeval2 packet
  anomaly <perlinger@ntp.org>, reported by GGarvey.
  - --enable-bug3527-fix support by HStenn
* [Bug 3526] Incorrect poll interval in packet <perlinger@ntp.org>
  - applied patch by Gerry Garvey
* [Bug 3471] Check for openssl/[ch]mac.h.  <perlinger@ntp.org>
  - added missing check, reported by Reinhard Max <perlinger@ntp.org>
* [Bug 1674] runtime crashes and sync problems affecting both x86 and x86_64
  - this is a variant of [bug 3558] and should be fixed with it
* Implement 'configure --disable-signalled-io'

--
NTP 4.2.8p12 (Harlan Stenn <stenn@ntp.org>, 2018/14/09)

Focus: Security, Bug fixes, enhancements.

Severity: MEDIUM

This release fixes a "hole" in the noepeer capability introduced to ntpd
in ntp-4.2.8p11, and a buffer overflow in the openhost() function used by
ntpq and ntpdc.  It also provides 26 other bugfixes, and 4 other improvements:

* [Sec 3505] Buffer overflow in the openhost() call of ntpq and ntpdc.

* [Sec 3012] Fix a hole in the new "noepeer" processing.

* Bug Fixes:
 [Bug 3521] Fix a logic bug in the INVALIDNAK checks.  <stenn@ntp.org>
 [Bug 3509] Add support for running as non-root on FreeBSD, Darwin,
            other TrustedBSD platforms
 - applied patch by Ian Lepore <perlinger@ntp.org>
 [Bug 3506] Service Control Manager interacts poorly with NTPD <perlinger@ntp.org>
 - changed interaction with SCM to signal pending startup
 [Bug 3486] Buffer overflow in ntpq/ntpq.c:tstflags() <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3485] Undefined sockaddr used in error messages in ntp_config.c <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3484] ntpq response from ntpd is incorrect when REFID is null <perlinger@ntp.org>
 - rework of ntpq 'nextvar()' key/value parsing
 [Bug 3482] Fixes for compilation warnings (ntp_io.c & ntpq-subs.c) <perlinger@ntp.org>
 - applied patch by Gerry Garvey (with mods)
 [Bug 3480] Refclock sample filter not cleared on clock STEP <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3479] ctl_putrefid() allows unsafe characters through to ntpq <perlinger@ntp.org>
 - applied patch by Gerry Garvey (with mods)
 [Bug 3476]ctl_putstr() sends empty unquoted string [...] <perlinger@ntp.org>
 - applied patch by Gerry Garvey (with mods); not sure if that's bug or feature, though
 [Bug 3475] modify prettydate() to suppress output of zero time <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3474] Missing pmode in mode7 peer info response <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3471] Check for openssl/[ch]mac.h.  HStenn.
 - add #define ENABLE_CMAC support in configure.  HStenn.
 [Bug 3470] ntpd4.2.8p11 fails to compile without OpenSSL <perlinger@ntp.org>
 [Bug 3469] Incomplete string compare [...] in is_refclk_addr <perlinger@ntp.org>
 - patch by Stephen Friedl
 [Bug 3467] Potential memory fault in ntpq [...] <perlinger@ntp.org>
 - fixed IO redirection and CTRL-C handling in ntq and ntpdc
 [Bug 3465] Default TTL values cannot be used <perlinger@ntp.org>
 [Bug 3461] refclock_shm.c: clear error status on clock recovery <perlinger@ntp.org>
 - initial patch by Hal Murray; also fixed refclock_report() trouble
 [Bug 3460] Fix typo in ntpq.texi, reported by Kenyon Ralph.  <stenn@ntp.org>
 [Bug 3456] Use uintptr_t rather than size_t to store an integer in a pointer
 - According to Brooks Davis, there was only one location <perlinger@ntp.org>
 [Bug 3449] ntpq - display "loop" instead of refid [...] <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3445] Symmetric peer won't sync on startup <perlinger@ntp.org>
 - applied patch by Gerry Garvey
 [Bug 3442] Fixes for ntpdate as suggested by Gerry Garvey,
 with modifications
 New macro REFID_ISTEXT() which is also used in ntpd/ntp_control.c.
 [Bug 3434] ntpd clears STA_UNSYNC on start <perlinger@ntp.org>
 - applied patch by Miroslav Lichvar
 [Bug 3426] ntpdate.html -t default is 2 seconds.  Leonid Evdokimov.
 [Bug 3121] Drop root privileges for the forked DNS worker <perlinger@ntp.org>
 - integrated patch by  Reinhard Max
 [Bug 2821] minor build issues <perlinger@ntp.org>
 - applied patches by Christos Zoulas, including real bug fixes
 html/authopt.html: cleanup, from <stenn@ntp.org>
 ntpd/ntpd.c: DROPROOT cleanup.  <stenn@ntp.org>
 Symmetric key range is 1-65535.  Update docs.   <stenn@ntp.org>

--
NTP 4.2.8p11 (Harlan Stenn <stenn@ntp.org>, 2018/02/27)

Focus: Security, Bug fixes, enhancements.

Severity: MEDIUM

This release fixes 2 low-/medium-, 1 informational/medum-, and 2 low-severity
vulnerabilities in ntpd, one medium-severity vulernability in ntpq, and
provides 65 other non-security fixes and improvements:

* NTP Bug 3454: Unauthenticated packet can reset authenticated interleaved
	association (LOW/MED)
   Date Resolved: Stable (4.2.8p11) 27 Feb 2018
   References: Sec 3454 / CVE-2018-7185 / VU#961909
   Affects: ntp-4.2.6, up to but not including ntp-4.2.8p11.
   CVSS2: MED 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P) This could score between
	2.9 and 6.8.
   CVSS3: LOW 3.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L This could
	score between 2.6 and 3.1
   Summary:
	The NTP Protocol allows for both non-authenticated and
	authenticated associations, in client/server, symmetric (peer),
	and several broadcast modes. In addition to the basic NTP
	operational modes, symmetric mode and broadcast servers can
	support an interleaved mode of operation. In ntp-4.2.8p4 a bug
	was inadvertently introduced into the protocol engine that
	allows a non-authenticated zero-origin (reset) packet to reset
	an authenticated interleaved peer association. If an attacker
	can send a packet with a zero-origin timestamp and the source
	IP address of the "other side" of an interleaved association,
	the 'victim' ntpd will reset its association. The attacker must
	continue sending these packets in order to maintain the
	disruption of the association. In ntp-4.0.0 thru ntp-4.2.8p6,
	interleave mode could be entered dynamically. As of ntp-4.2.8p7,
	interleaved mode must be explicitly configured/enabled.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p11, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page.
	If you are unable to upgrade to 4.2.8p11 or later and have
	    'peer HOST xleave' lines in your ntp.conf file, remove the
	    'xleave' option.
	Have enough sources of time.
	Properly monitor your ntpd instances.
	If ntpd stops running, auto-restart it without -g .
   Credit:
   	This weakness was discovered by Miroslav Lichvar of Red Hat.

* NTP Bug 3453: Interleaved symmetric mode cannot recover from bad
	state (LOW/MED)
   Date Resolved: Stable (4.2.8p11) 27 Feb 2018
   References: Sec 3453 / CVE-2018-7184 / VU#961909
   Affects: ntpd in ntp-4.2.8p4, up to but not including ntp-4.2.8p11.
   CVSS2: MED 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
	Could score between 2.9 and 6.8.
   CVSS3: LOW 3.1 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
	Could score between 2.6 and 6.0.
   Summary:
   	The fix for NtpBug2952 was incomplete, and while it fixed one
	problem it created another.  Specifically, it drops bad packets
	before updating the "received" timestamp.  This means a
	third-party can inject a packet with a zero-origin timestamp,
	meaning the sender wants to reset the association, and the
	transmit timestamp in this bogus packet will be saved as the
	most recent "received" timestamp.  The real remote peer does
	not know this value and this will disrupt the association until
	the association resets.
   Mitigation:
	Implement BCP-38.
	Upgrade to ntp-4.2.8p11 or later from the NTP Project Download Page
	    or the NTP Public Services Project Download Page.
	Use authentication with 'peer' mode.
	Have enough sources of time.
	Properly monitor your ntpd instances.
	If ntpd stops running, auto-restart it without -g .
   Credit:
   	This weakness was discovered by Miroslav Lichvar of Red Hat.

* NTP Bug 3415: Provide a way to prevent authenticated symmetric passive
	peering (LOW)
   Date Resolved: Stable (4.2.8p11) 27 Feb 2018
   References: Sec 3415 / CVE-2018-7170 / VU#961909
   	       Sec 3012 / CVE-2016-1549 / VU#718152
   Affects: All ntp-4 releases up to, but not including 4.2.8p7, and
   	4.3.0 up to, but not including 4.3.92.  Resolved in 4.2.8p11.
   CVSS2: LOW 3.5 - (AV:N/AC:M/Au:S/C:N/I:P/A:N)
   CVSS3: LOW 3.1 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
   Summary:
	ntpd can be vulnerable to Sybil attacks.  If a system is set up to
	use a trustedkey and if one is not using the feature introduced in
	ntp-4.2.8p6 allowing an optional 4th field in the ntp.keys file to
	specify which IPs can serve time, a malicious authenticated peer
	-- i.e. one where the attacker knows the private symmetric key --
	can create arbitrarily-many ephemeral associations in order to win
	the clock selection of ntpd and modify a victim's clock.  Three
	additional protections are offered in ntp-4.2.8p11.  One is the
	new 'noepeer' directive, which disables symmetric passive
	ephemeral peering. Another is the new 'ippeerlimit' directive,
	which limits the number of peers that can be created from an IP.
	The third extends the functionality of the 4th field in the
	ntp.keys file to include specifying a subnet range.
   Mitigation:
	Implement BCP-38.
	Upgrade to ntp-4.2.8p11 or later from the NTP Project Download Page
	    or the NTP Public Services Project Download Page.
	Use the 'noepeer' directive to prohibit symmetric passive
	    ephemeral associations.
	Use the 'ippeerlimit' directive to limit the number of peers
	    that can be created from an IP.
	Use the 4th argument in the ntp.keys file to limit the IPs and
	    subnets that can be time servers.
	Have enough sources of time.
	Properly monitor your ntpd instances.
	If ntpd stops running, auto-restart it without -g .
   Credit:
	This weakness was reported as Bug 3012 by Matthew Van Gundy of
	Cisco ASIG, and separately by Stefan Moser as Bug 3415.

* ntpq Bug 3414: decodearr() can write beyond its 'buf' limits (Medium)
   Date Resolved: 27 Feb 2018
   References: Sec 3414 / CVE-2018-7183 / VU#961909
   Affects: ntpq in ntp-4.2.8p6, up to but not including ntp-4.2.8p11.
   CVSS2: MED 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
   CVSS3: MED 5.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
   Summary:
   	ntpq is a monitoring and control program for ntpd.  decodearr()
	is an internal function of ntpq that is used to -- wait for it --
	decode an array in a response string when formatted data is being
	displayed.  This is a problem in affected versions of ntpq if a
	maliciously-altered ntpd returns an array result that will trip this
	bug, or if a bad actor is able to read an ntpq request on its way to
	a remote ntpd server and forge and send a response before the remote
	ntpd sends its response.  It's potentially possible that the
	malicious data could become injectable/executable code.
   Mitigation:
	Implement BCP-38.
	Upgrade to ntp-4.2.8p11 or later from the NTP Project Download Page
	    or the NTP Public Services Project Download Page.
   Credit:
	This weakness was discovered by Michael Macnair of Thales e-Security.

* NTP Bug 3412: ctl_getitem(): buffer read overrun leads to undefined
	behavior and information leak (Info/Medium)
   Date Resolved: 27 Feb 2018
   References: Sec 3412 / CVE-2018-7182 / VU#961909
   Affects: ntp-4.2.8p6, up to but not including ntp-4.2.8p11.
   CVSS2: INFO 0.0 - MED 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) 0.0 if C:N
   CVSS3: NONE 0.0 - MED 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
	0.0 if C:N
   Summary:
	ctl_getitem()  is used by ntpd to process incoming mode 6 packets.
	A malicious mode 6 packet can be sent to an ntpd instance, and
	if the ntpd instance is from 4.2.8p6 thru 4.2.8p10, that will
	cause ctl_getitem() to read past the end of its buffer.
   Mitigation:
	Implement BCP-38.
	Upgrade to ntp-4.2.8p11 or later from the NTP Project Download Page
	    or the NTP Public Services Project Download Page.
	Have enough sources of time.
	Properly monitor your ntpd instances.
	If ntpd stops running, auto-restart it without -g .
   Credit:
   	This weakness was discovered by Yihan Lian of Qihoo 360.

* NTP Bug 3012: Sybil vulnerability: ephemeral association attack
   Also see Bug 3415, above.
   Date Mitigated: Stable (4.2.8p7) 26 Apr 2016; Dev (4.3.92) 26 Apr 2016
   Date Resolved: Stable (4.2.8p11) 27 Feb 2018
   References: Sec 3012 / CVE-2016-1549 / VU#718152
   Affects: All ntp-4 releases up to, but not including 4.2.8p7, and
	4.3.0 up to, but not including 4.3.92.  Resolved in 4.2.8p11.
   CVSS2: LOW 3.5 - (AV:N/AC:M/Au:S/C:N/I:P/A:N)
   CVSS3: MED 5.3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
   Summary:
	ntpd can be vulnerable to Sybil attacks.  If a system is set up
	to use a trustedkey and if one is not using the feature
	introduced in ntp-4.2.8p6 allowing an optional 4th field in the
	ntp.keys file to specify which IPs can serve time, a malicious
	authenticated peer -- i.e. one where the attacker knows the
	private symmetric key -- can create arbitrarily-many ephemeral
	associations in order to win the clock selection of ntpd and
	modify a victim's clock.  Two additional protections are
	offered in ntp-4.2.8p11.  One is the 'noepeer' directive, which
	disables symmetric passive ephemeral peering. The other extends
	the functionality of the 4th field in the ntp.keys file to
	include specifying a subnet range.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p11, or later, from the NTP Project Download Page or
	    the NTP Public Services Project Download Page.
	Use the 'noepeer' directive to prohibit symmetric passive
	    ephemeral associations.
	Use the 'ippeerlimit' directive to limit the number of peer
	    associations from an IP.
	Use the 4th argument in the ntp.keys file to limit the IPs
	    and subnets that can be time servers.
	Properly monitor your ntpd instances.
   Credit:
   	This weakness was discovered by Matthew Van Gundy of Cisco ASIG.

* Bug fixes:
 [Bug 3457] OpenSSL FIPS mode regression <perlinger@ntp.org>
 [Bug 3455] ntpd doesn't use scope id when binding multicast <perlinger@ntp.org>
 - applied patch by Sean Haugh 
 [Bug 3452] PARSE driver prints uninitialized memory. <perlinger@ntp.org>
 [Bug 3450] Dubious error messages from plausibility checks in get_systime()
 - removed error log caused by rounding/slew, ensured postcondition <perlinger@ntp.org>
 [Bug 3447] AES-128-CMAC (fixes) <perlinger@ntp.org>
 - refactoring the MAC code, too
 [Bug 3441] Validate the assumption that AF_UNSPEC is 0.  stenn@ntp.org
 [Bug 3439] When running multiple commands / hosts in ntpq... <perlinger@ntp.org>
 - applied patch by ggarvey
 [Bug 3438] Negative values and values > 999 days in... <perlinger@ntp.org>
 - applied patch by ggarvey (with minor mods)
 [Bug 3437] ntpd tries to open socket with AF_UNSPEC domain
 - applied patch (with mods) by Miroslav Lichvar <perlinger@ntp.org>
 [Bug 3435] anchor NTP era alignment <perlinger@ntp.org>
 [Bug 3433] sntp crashes when run with -a.  <stenn@ntp.org>
 [Bug 3430] ntpq dumps core (SIGSEGV) for "keytype md2"
 - fixed several issues with hash algos in ntpd, sntp, ntpq,
   ntpdc and the test suites <perlinger@ntp.org>
 [Bug 3424] Trimble Thunderbolt 1024 week millenium bug <perlinger@ntp.org>
 - initial patch by Daniel Pouzzner
 [Bug 3423] QNX adjtime() implementation error checking is
 wrong <perlinger@ntp.org>
 [Bug 3417] ntpq ifstats packet counters can be negative
 made IFSTATS counter quantities unsigned <perlinger@ntp.org>
 [Bug 3411] problem about SIGN(6) packet handling for ntp-4.2.8p10
 - raised receive buffer size to 1200 <perlinger@ntp.org>
 [Bug 3408] refclock_jjy.c: Avoid a wrong report of the coverity static
 analysis tool. <abe@ntp.org>
 [Bug 3405] update-leap.in: general cleanup, HTTPS support.  Paul McMath.
 [Bug 3404] Fix openSSL DLL usage under Windows <perlinger@ntp.org>
 - fix/drop assumptions on OpenSSL libs directory layout
 [Bug 3399] NTP: linker error in 4.2.8p10 during Linux cross-compilation
 - initial patch by timeflies@mail2tor.com  <perlinger@ntp.org>
 [Bug 3398] tests fail with core dump <perlinger@ntp.org>
 - patch contributed by Alexander Bluhm
 [Bug 3397] ctl_putstr() asserts that data fits in its buffer
 rework of formatting & data transfer stuff in 'ntp_control.c'
 avoids unecessary buffers and size limitations. <perlinger@ntp.org>
 [Bug 3394] Leap second deletion does not work on ntpd clients
 - fixed handling of dynamic deletion w/o leap file <perlinger@ntp.org>
 [Bug 3391] ntpd segfaults on startup due to small warmup thread stack size
 - increased mimimum stack size to 32kB <perlinger@ntp.org>
 [Bug 3367] Faulty LinuxPPS NMEA clock support in 4.2.8 <perlinger@ntp.org>
 - reverted handling of PPS kernel consumer to 4.2.6 behavior
 [Bug 3365] Updates driver40(-ja).html and miscopt.html <abe@ntp.org>
 [Bug 3358] Spurious KoD log messages in .INIT. phase.  HStenn.
 [Bug 3016] wrong error position reported for bad ":config pool"
 - fixed location counter & ntpq output <perlinger@ntp.org>
 [Bug 2900] libntp build order problem.  HStenn.
 [Bug 2878] Tests are cluttering up syslog <perlinger@ntp.org>
 [Bug 2737] Wrong phone number listed for USNO. ntp-bugs@bodosom.net,
 perlinger@ntp.org
 [Bug 2557] Fix Thunderbolt init. ntp-bugs@bodosom.net, perlinger@ntp.
 [Bug 948] Trustedkey config directive leaks memory. <perlinger@ntp.org>
 Use strlcpy() to copy strings, not memcpy().  HStenn.
 Typos.  HStenn.
 test_ntp_scanner_LDADD needs ntpd/ntp_io.o.  HStenn.
 refclock_jjy.c: Add missing "%s" to an msyslog() call.  HStenn.
 Build ntpq and libntpq.a with NTP_HARD_*FLAGS.  perlinger@ntp.org
 Fix trivial warnings from 'make check'. perlinger@ntp.org
 Fix bug in the override portion of the compiler hardening macro. HStenn.
 record_raw_stats(): Log entire packet.  Log writes.  HStenn.
 AES-128-CMAC support.  BInglis, HStenn, JPerlinger.
 sntp: tweak key file logging.  HStenn.
 sntp: pkt_output(): Improve debug output.  HStenn.
 update-leap: updates from Paul McMath.
 When using pkg-config, report --modversion.  HStenn.
 Clean up libevent configure checks.  HStenn.
 sntp: show the IP of who sent us a crypto-NAK.  HStenn.
 Allow .../N to specify subnet bits for IPs in ntp.keys.  HStenn, JPerlinger.
 authistrustedip() - use it in more places.  HStenn, JPerlinger.
 New sysstats: sys_lamport, sys_tsrounding.  HStenn.
 Update ntp.keys .../N documentation.  HStenn.
 Distribute testconf.yml.  HStenn.
 Add DPRINTF(2,...) lines to receive() for packet drops.  HStenn.
 Rename the configuration flag fifo variables.  HStenn.
 Improve saveconfig output.  HStenn.
 Decode restrict flags on receive() debug output.  HStenn.
 Decode interface flags on receive() debug output.  HStenn.
 Warn the user if deprecated "driftfile name WanderThreshold" is used.  HStenn.
 Update the documentation in ntp.conf.def .  HStenn.
 restrictions() must return restrict flags and ippeerlimit.  HStenn.
 Update ntpq peer documentation to describe the 'p' type.  HStenn.
 Rename restrict 'flags' to 'rflags.  Use an enum for the values.  HStenn.
 Provide dump_restricts() for debugging.  HStenn.
 Use consistent 4th arg type for [gs]etsockopt.  JPerlinger.

* Other items:

* update-leap needs the following perl modules:
	Net::SSLeay
	IO::Socket::SSL

* New sysstats variables: sys_lamport, sys_tsrounding
See them with: ntpq -c "rv 0 ss_lamport,ss_tsrounding"
sys_lamport counts the number of observed Lamport violations, while
sys_tsrounding counts observed timestamp rounding events.

* New ntp.conf items:

- restrict ... noepeer
- restrict ... ippeerlimit N

The 'noepeer' directive will disallow all ephemeral/passive peer
requests.

The 'ippeerlimit' directive limits the number of time associations
for each IP in the designated set of addresses.  This limit does not
apply to explicitly-configured associations.  A value of -1, the current
default, means an unlimited number of associations may connect from a
single IP.  0 means "none", etc.  Ordinarily the only way multiple
associations would come from the same IP would be if the remote side
was using a proxy.  But a trusted machine might become compromised,
in which case an attacker might spin up multiple authenticated sessions
from different ports.  This directive should be helpful in this case.

* New ntp.keys feature: Each IP in the optional list of IPs in the 4th
field may contain a /subnetbits specification, which identifies  the
scope of IPs that may use this key.  This IP/subnet restriction can be
used to limit the IPs that may use the key in most all situations where
a key is used.
--
NTP 4.2.8p10 (Harlan Stenn <stenn@ntp.org>, 2017/03/21) 

Focus: Security, Bug fixes, enhancements.

Severity: MEDIUM

This release fixes 5 medium-, 6 low-, and 4 informational-severity
vulnerabilities, and provides 15 other non-security fixes and improvements:

* NTP-01-016 NTP: Denial of Service via Malformed Config (Medium)
   Date Resolved: 21 Mar 2017
   References: Sec 3389 / CVE-2017-6464 / VU#325339
   Affects: All versions of NTP-4, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: MED 4.6 (AV:N/AC:H/Au:M/C:N/I:N/A:C)
   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
   Summary:
	A vulnerability found in the NTP server makes it possible for an
	authenticated remote user to crash ntpd via a malformed mode
	configuration directive.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page or
	    the NTP Public Services Project Download Page
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-014 NTP: Buffer Overflow in DPTS Clock (Low)
    Date Resolved: 21 Mar 2017
    References: Sec 3388 / CVE-2017-6462 / VU#325339
    Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not including ntp-4.3.94.
    CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
    CVSS3: Low 1.6 CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
    Summary:
	There is a potential for a buffer overflow in the legacy Datum
	Programmable Time Server refclock driver.  Here the packets are
	processed from the /dev/datum device and handled in
	datum_pts_receive().  Since an attacker would be required to
	somehow control a malicious /dev/datum device, this does not
	appear to be a practical attack and renders this issue "Low" in
	terms of severity.
   Mitigation:
	If you have a Datum reference clock installed and think somebody
	    may maliciously change the device, upgrade to 4.2.8p10, or
	    later, from the NTP Project Download Page or the NTP Public
	    Services Project Download Page
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-012 NTP: Authenticated DoS via Malicious Config Option (Medium)
   Date Resolved: 21 Mar 2017
   References: Sec 3387 / CVE-2017-6463 / VU#325339
   Affects: All versions of ntp, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: MED 4.6 (AV:N/AC:H/Au:M/C:N/I:N/A:C)
   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
   Summary:
	A vulnerability found in the NTP server allows an authenticated
	remote attacker to crash the daemon by sending an invalid setting
	via the :config directive.  The unpeer option expects a number or
	an address as an argument.  In case the value is "0", a
	segmentation fault occurs.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page 
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-011 NTP: ntpq_stripquotes() returns incorrect value (Informational)
   Date Resolved: 21 Mar 2017
   References: Sec 3386
   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: None 0.0 (AV:N/AC:H/Au:N/C:N/I:N/A:N)
   CVSS3: None 0.0 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:N
   Summary:
	The NTP Mode 6 monitoring and control client, ntpq, uses the
	function ntpq_stripquotes() to remove quotes and escape characters
	from a given string.  According to the documentation, the function
	is supposed to return the number of copied bytes but due to
	incorrect pointer usage this value is always zero.  Although the
	return value of this function is never used in the code, this
	flaw could lead to a vulnerability in the future.  Since relying
	on wrong return values when performing memory operations is a
	dangerous practice, it is recommended to return the correct value
	in accordance with the documentation pertinent to the code.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-010 NTP: ereallocarray()/eallocarray() underused (Info)
   Date Resolved: 21 Mar 2017
   References: Sec 3385
   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   Summary:
	NTP makes use of several wrappers around the standard heap memory
	allocation functions that are provided by libc.  This is mainly
	done to introduce additional safety checks concentrated on
	several goals.  First, they seek to ensure that memory is not
	accidentally freed, secondly they verify that a correct amount
	is always allocated and, thirdly, that allocation failures are
	correctly handled.  There is an additional implementation for
	scenarios where memory for a specific amount of items of the
	same size needs to be allocated.  The handling can be found in
	the oreallocarray() function for which a further number-of-elements
	parameter needs to be provided.  Although no considerable threat
	was identified as tied to a lack of use of this function, it is
	recommended to correctly apply oreallocarray() as a preferred
	option across all of the locations where it is possible.
   Mitigation:
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-009 NTP: Privileged execution of User Library code (WINDOWS
	PPSAPI ONLY) (Low)
   Date Resolved: 21 Mar 2017
   References: Sec 3384 / CVE-2017-6455 / VU#325339
   Affects: All Windows versions of ntp-4 that use the PPSAPI, up to but
	not including ntp-4.2.8p10, and ntp-4.3.0 up to, but not
	including ntp-4.3.94.
   CVSS2: MED 3.8 (AV:L/AC:H/Au:S/C:N/I:N/A:C)
   CVSS3: MED 4.0 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
   Summary:
	The Windows NT port has the added capability to preload DLLs
	defined in the inherited global local environment variable
	PPSAPI_DLLS.  The code contained within those libraries is then
	called from the NTPD service, usually running with elevated
	privileges. Depending on how securely the machine is setup and
	configured, if ntpd is configured to use the PPSAPI under Windows
	this can easily lead to a code injection.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page 
   Credit:
   This weakness was discovered by Cure53. 

* NTP-01-008 NTP: Stack Buffer Overflow from Command Line (WINDOWS
	installer ONLY) (Low)
   Date Resolved: 21 Mar 2017
   References: Sec 3383 / CVE-2017-6452 / VU#325339
   Affects: WINDOWS installer ONLY: All versions of the ntp-4 Windows
	installer, up to but not including ntp-4.2.8p10, and ntp-4.3.0 up
	to, but not including ntp-4.3.94.
   CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
   CVSS3: Low 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
   Summary:
	The Windows installer for NTP calls strcat(), blindly appending
	the string passed to the stack buffer in the addSourceToRegistry()
	function.  The stack buffer is 70 bytes smaller than the buffer
	in the calling main() function.  Together with the initially
	copied Registry path, the combination causes a stack buffer
	overflow and effectively overwrites the stack frame.  The
	passed application path is actually limited to 256 bytes by the
	operating system, but this is not sufficient to assure that the
	affected stack buffer is consistently protected against
	overflowing at all times.
   Mitigation:
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	or the NTP Public Services Project Download Page 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-007 NTP: Data Structure terminated insufficiently (WINDOWS
	installer ONLY) (Low)
   Date Resolved: 21 Mar 2017
   References: Sec 3382 / CVE-2017-6459 / VU#325339
   Affects: WINDOWS installer ONLY: All ntp-4 versions of the Windows
	installer, up to but not including ntp-4.2.8p10, and ntp-4.3.0
	up to, but not including ntp-4.3.94.
   CVSS2: Low 1.0 (AV:L/AC:H/Au:S/C:N/I:N/A:P)
   CVSS3: Low 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
   Summary:
	The Windows installer for NTP calls strcpy() with an argument
	that specifically contains multiple null bytes.  strcpy() only
	copies a single terminating null character into the target
	buffer instead of copying the required double null bytes in the
	addKeysToRegistry() function.  As a consequence, a garbage
	registry entry can be created.  The additional arsize parameter
	is erroneously set to contain two null bytes and the following
	call to RegSetValueEx() claims to be passing in a multi-string
	value, though this may not be true.
   Mitigation:
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-006 NTP: Copious amounts of Unused Code (Informational)
   References: Sec 3381
   Summary:
	The report says: Statically included external projects
	potentially introduce several problems and the issue of having
	extensive amounts of code that is "dead" in the resulting binary
	must clearly be pointed out.  The unnecessary unused code may or
	may not contain bugs and, quite possibly, might be leveraged for
	code-gadget-based branch-flow redirection exploits.  Analogically,
	having source trees statically included as well means a failure
	in taking advantage of the free feature for periodical updates.
	This solution is offered by the system's Package Manager. The
	three libraries identified are libisc, libevent, and libopts.
   Resolution:
	For libisc, we already only use a portion of the original library.
	We've found and fixed bugs in the original implementation (and
	offered the patches to ISC), and plan to see what has changed
	since we last upgraded the code.  libisc is generally not
	installed, and when it it we usually only see the static libisc.a
	file installed.  Until we know for sure that the bugs we've found
	and fixed are fixed upstream, we're better off with the copy we
	are using.

        Version 1 of libevent was the only production version available
	until recently, and we've been requiring version 2 for a long time.
	But if the build system has at least version 2 of libevent
	installed, we'll use the version that is installed on the system.
	Otherwise, we provide a copy of libevent that we know works.

        libopts is provided by GNU AutoGen, and that library and package
	undergoes frequent API version updates.  The version of autogen
	used to generate the tables for the code must match the API
	version in libopts.  AutoGen can be ... difficult to build and
	install, and very few developers really need it.  So we have it
	on our build and development machines, and we provide the
	specific version of the libopts code in the distribution to make
	sure that the proper API version of libopts is available.

        As for the point about there being code in these libraries that
	NTP doesn't use, OK.  But other packages used these libraries as
	well, and it is reasonable to assume that other people are paying
	attention to security and code quality issues for the overall
	libraries.  It takes significant resources to analyze and
	customize these libraries to only include what we need, and to
	date we believe the cost of this effort does not justify the benefit. 
   Credit:
	This issue was discovered by Cure53. 

* NTP-01-005 NTP: Off-by-one in Oncore GPS Receiver (Low)
   Date Resolved: 21 Mar 2017
   References: Sec 3380
   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
   	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: None 0.0 (AV:L/AC:H/Au:N/C:N/I:N/A:N)
   CVSS3: None 0.0 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N
   Summary:
	There is a fencepost error in a "recovery branch" of the code for
	the Oncore GPS receiver if the communication link to the ONCORE
	is weak / distorted and the decoding doesn't work.
   Mitigation:
        Upgrade to 4.2.8p10, or later, from the NTP Project Download Page or
	    the NTP Public Services Project Download Page
        Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-004 NTP: Potential Overflows in ctl_put() functions (Medium)
   Date Resolved: 21 Mar 2017
   References: Sec 3379 / CVE-2017-6458 / VU#325339
   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: MED 4.6 (AV:N/AC:H/Au:M/C:N/I:N/A:C)
   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
   Summary:
	ntpd makes use of different wrappers around ctl_putdata() to
	create name/value ntpq (mode 6) response strings.  For example,
	ctl_putstr() is usually used to send string data (variable names
	or string data).  The formatting code was missing a length check
	for variable names.  If somebody explicitly created any unusually
	long variable names in ntpd (longer than 200-512 bytes, depending
	on the type of variable), then if any of these variables are
	added to the response list it would overflow a buffer.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page
	If you don't want to upgrade, then don't setvar variable names
	    longer than 200-512 bytes in your ntp.conf file.
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-003 NTP: Improper use of snprintf() in mx4200_send() (Low)
   Date Resolved: 21 Mar 2017
   References: Sec 3378 / CVE-2017-6451 / VU#325339
   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: LOW 0.8 (AV:L/AC:H/Au:M/C:N/I:N/A:P)
   CVSS3: LOW 1.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
   Summary:
	The legacy MX4200 refclock is only built if is specifically
	enabled, and furthermore additional code changes are required to
	compile and use it.  But it uses the libc functions snprintf()
	and vsnprintf() incorrectly, which can lead to an out-of-bounds
	memory write due to an improper handling of the return value of
	snprintf()/vsnprintf().  Since the return value is used as an
	iterator and it can be larger than the buffer's size, it is
	possible for the iterator to point somewhere outside of the
	allocated buffer space.  This results in an out-of-bound memory
	write.  This behavior can be leveraged to overwrite a saved
	instruction pointer on the stack and gain control over the
	execution flow.  During testing it was not possible to identify
	any malicious usage for this vulnerability.  Specifically, no
	way for an attacker to exploit this vulnerability was ultimately
	unveiled.  However, it has the potential to be exploited, so the
	code should be fixed.
   Mitigation, if you have a Magnavox MX4200 refclock:
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page.
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-002 NTP: Buffer Overflow in ntpq when fetching reslist from a
	malicious ntpd (Medium)
   Date Resolved: 21 Mar 2017
   References: Sec 3377 / CVE-2017-6460 / VU#325339
   Affects: All versions of ntpq, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: MED 4.9 (AV:N/AC:H/Au:S/C:N/I:N/A:C)
   CVSS3: MED 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H
   Summary:
	A stack buffer overflow in ntpq can be triggered by a malicious
	ntpd server when ntpq requests the restriction list from the server.
	This is due to a missing length check in the reslist() function.
	It occurs whenever the function parses the server's response and
	encounters a flagstr variable of an excessive length.  The string
	will be copied into a fixed-size buffer, leading to an overflow on
	the function's stack-frame.  Note well that this problem requires
	a malicious server, and affects ntpq, not ntpd.
   Mitigation:
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page
	If you can't upgrade your version of ntpq then if you want to know
	    the reslist of an instance of ntpd that you do not control,
	    know that if the target ntpd is malicious that it can send back
	    a response that intends to crash your ntpq process. 
   Credit:
	This weakness was discovered by Cure53. 

* NTP-01-001 NTP: Makefile does not enforce Security Flags (Informational)
   Date Resolved: 21 Mar 2017
   References: Sec 3376
   Affects: All versions of NTP, up to but not including ntp-4.2.8p10, and
	ntp-4.3.0 up to, but not including ntp-4.3.94.
   CVSS2: N/A
   CVSS3: N/A
   Summary:
	The build process for NTP has not, by default, provided compile
	or link flags to offer "hardened" security options.  Package
	maintainers have always been able to provide hardening security
	flags for their builds.  As of ntp-4.2.8p10, the NTP build
	system has a way to provide OS-specific hardening flags.  Please
	note that this is still not a really great solution because it
	is specific to NTP builds.  It's inefficient to have every
	package supply, track and maintain this information for every
	target build.  It would be much better if there was a common way
	for OSes to provide this information in a way that arbitrary
	packages could benefit from it.
   Mitigation:
	Implement BCP-38.
	Upgrade to 4.2.8p10, or later, from the NTP Project Download Page
	    or the NTP Public Services Project Download Page
	Properly monitor your ntpd instances, and auto-restart
	    ntpd (without -g) if it stops running. 
   Credit:
	This weakness was reported by Cure53. 

* 0rigin DoS (Medium)
   Date Resolved: 21 Mar 2017
   References: Sec 3361 / CVE-2016-9042 / VU#325339
   Affects: ntp-4.2.8p9 (21 Nov 2016), up to but not including ntp-4.2.8p10
   CVSS2: MED 4.9 (AV:N/AC:H/Au:N/C:N/I:N/A:C) (worst case)
   CVSS3: MED 4.4 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H (worst case)
   Summary:
	An exploitable denial of service vulnerability exists in the
	origin timestamp check functionality of ntpd 4.2.8p9.  A specially
	crafted unauthenticated network packet can be used to reset the
	expected origin timestamp for target peers.  Legitimate replies
	from targeted peers will fail the origin timestamp check (TEST2)
	causing the reply to be dropped and creating a denial of service
	condition.  This vulnerability can only be exploited if the
	attacker can spoof all of the servers.
   Mitigation:
	Implement BCP-38.
	Configure enough servers/peers that an attacker cannot target
	    all of your time sources.
