TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Multiple vulnerabilities released in NTP

174 点作者 mahmoudimus超过 10 年前

19 条评论

dfc超过 10 年前
PHK has been working on a rewrite of ntp sponsored by the Linux Foundation. He has posted a couple of entries about his progress so far: <a href="http://phk.freebsd.dk/time/20140926.html" rel="nofollow">http:&#x2F;&#x2F;phk.freebsd.dk&#x2F;time&#x2F;20140926.html</a><p>In the meantime Miroslav&#x27;s chrony is a good alternative: <a href="http://chrony.tuxfamily.org/" rel="nofollow">http:&#x2F;&#x2F;chrony.tuxfamily.org&#x2F;</a><p>If you are looking for the fixed version you can grab 4.2.8 from archive.ntp.org which is still responding to requests: <a href="http://archive.ntp.org/ntp4/ntp-4.2/ntp-4.2.8.tar.gz" rel="nofollow">http:&#x2F;&#x2F;archive.ntp.org&#x2F;ntp4&#x2F;ntp-4.2&#x2F;ntp-4.2.8.tar.gz</a>
评论 #8774204 未加载
评论 #8776789 未加载
Sarkie超过 10 年前
<a href="http://webcache.googleusercontent.com/search?q=cache%3Asupport.ntp.org%2Fbin%2Fview%2FMain%2FSecurityNotice%23Buffer_overflow_in_ctl_putdata&amp;oq=cache%3Asupport.ntp.org%2Fbin%2Fview%2FMain%2FSecurityNotice%23Buffer_overflow_in_ctl_putdata&amp;aqs=chrome..69i57j69i58.798j0j4&amp;sourceid=chrome&amp;es_sm=0&amp;ie=UTF-8" rel="nofollow">http:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache%3Asuppo...</a>
xorcist超过 10 年前
It is important to know how NTP works before you set it up. Several of the comments seem to be misguided. NTP is a peer-to-peer protocol, there are no such thing as an &quot;NTP server&quot; or an &quot;NTP client&quot;.<p>NTP measures clock drift over a server group. It discovers enough about your topology to assign a statistical factor to each peer, so that a rogue or broken server can not bring down the whole group.<p>Known good time (which is what the stratum value is, a measure of distance to known good time) is then sprinkled in from several sources to drift the time in the direction of true time.<p>Exactly as you should have a number of secondary DNS servers in different AS, you should use several different time sources from different organizations. If you are bigger than a closet shop, you might as well put your own GPS receiver in there too when sparkfun sells them for $40, and enable authentication on it.
评论 #8776920 未加载
评论 #8777141 未加载
PhantomGremlin超过 10 年前
NTP is one of those old school Internet protocols that was developed in &quot;a more civilized age&quot;. The reference implementation &quot;growed like Topsy&quot; in an academic setting. So it&#x27;s not surprising that it has serious vulnerabilities.<p>Many years ago OpenBSD threw up their hands and just decided to roll their own, named OpenNTPD. It&#x27;s not nearly as full featured as the reference implementation, but it works fine for most people.<p>Edit: forgot to mention that OpenNTPD does privilege separation (don&#x27;t know if reference implementation has added that yet). Which means that &quot;executed with the privilege level of the ntpd process&quot; isn&#x27;t nearly as scary as when the process is running as root.
评论 #8773536 未加载
评论 #8774652 未加载
SCdF超过 10 年前
Random non-trolling question by someone who is genuinely unfamiliar with the problem space: is it worthwhile rewriting these utilities in a language that avoids these sorts of problems? Is it because they&#x27;re far more complicated than I realise and rewrites would create more problems that it solves? It is because until Rust is 1.0 there isn&#x27;t a language that is suitable? Or am I missunderstanding the problem completely?<p>My reasoning comes from the vast majority of problems I notice being from the edge cases in managing memory, and so if I understand correctly there is a whole suite of languages that mostly remove these problems.
评论 #8775765 未加载
评论 #8775992 未加载
评论 #8775405 未加载
cheeseprocedure超过 10 年前
Do these vulnerabilities impact a local ntpd instance responsible only for local timekeeping? (In other words, does a compromised machine in pool.ntp.org pose a threat?)
评论 #8775808 未加载
评论 #8775251 未加载
voidz超过 10 年前
The ntpd daemon does not run as root. So, how is it able to change the time of the system? Does it use setuid, or caps, or something else?<p>I wonder because this would also affect what arbitrary code could be run as the ntp user.
评论 #8773735 未加载
评论 #8774796 未加载
评论 #8773606 未加载
hiphopyo超过 10 年前
Might want to check out OpenBSD&#x27;s OpenNTPD:<p><a href="http://www.openntpd.org/" rel="nofollow">http:&#x2F;&#x2F;www.openntpd.org&#x2F;</a>
评论 #8773799 未加载
评论 #8773730 未加载
评论 #8773787 未加载
breadtk超过 10 年前
The site appears to be non-responsive, here is a cached version of the page: <a href="https://webcache.googleusercontent.com/search?q=cache:jMcfipOGXXwJ:support.ntp.org/bin/view/Main/SecurityNotice+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" rel="nofollow">https:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:jMcfip...</a>
PhantomGremlin超过 10 年前
Theo de Raadt of OpenBSD weighs in on this issue:<p><a href="http://www.mail-archive.com/tech@openbsd.org/msg21729.html" rel="nofollow">http:&#x2F;&#x2F;www.mail-archive.com&#x2F;tech@openbsd.org&#x2F;msg21729.html</a>
arca_vorago超过 10 年前
This is interesting timing, I was just in the freenode #linux channel yesterday asking about security issues with NTP. I got told it was a non-issue and that I was &quot;tilting at windmills&quot;. I have been using chronyd in Alpine linux to good effect so far, but have really been wondering how bad it would be if I just turned it all off.
评论 #8773928 未加载
评论 #8775458 未加载
AgentME超过 10 年前
All of the buffer overflows are on the stack, right? Shouldn&#x27;t the default stack protector that most compilers today enable should stop that from being exploitable for remote code execution?<p>I&#x27;m just trying to estimate the likelihood that anyone was hacked through this vulnerability. Even with stack protection the vulnerability could be used to crash ntp, so upgrading is a very good idea still.
评论 #8774905 未加载
hannob超过 10 年前
The best solution is not to use ntp anyway. It&#x27;s an unencrypted, unauthenticated protocol vulnerable to Man in the Middle attacks. There was a pretty neat attack presented at BH Europe circumventing HSTS with a MitM-attack on NTP.<p>Better just replace it with tlsdate.
评论 #8774133 未加载
评论 #8775823 未加载
评论 #8774080 未加载
评论 #8775441 未加载
jbarham超过 10 年前
Naturally DJB recognized and fixed the security problems of NTP, way back in 1998: <a href="http://cr.yp.to/clockspeed.html" rel="nofollow">http:&#x2F;&#x2F;cr.yp.to&#x2F;clockspeed.html</a><p><i>Plus ça change, plus c&#x27;est la même chose...</i>
ck2超过 10 年前
<i>A remote attacker can send a carefully crafted packet that can overflow a stack buffer and potentially allow malicious code to be executed with the privilege level of the ntpd process.</i><p>Geez, in a time sync program? Nothing is safe anymore.
评论 #8773926 未加载
tux超过 10 年前
&quot;The connection was reset&quot; something weird going on. Lots of HN articles is been removed by some one. Many sites I visited today, is just down.
kator超过 10 年前
Do these apply to ntpd in OSX?
评论 #8775064 未加载
adrr超过 10 年前
Bad timing for such a vulnerability with the holidays and everything. I don&#x27;t have time for that.
评论 #8774627 未加载
SEJeff超过 10 年前
Just give it a few weeks and I&#x27;m sure the systemd developers will make their own &quot;newer and better&quot; ntpd.
评论 #8774846 未加载