NTF’s Network Time Protocol (NTP) Project released ntp-4.2.8p9 on 21 November 2016, its first update since ntp-4.2.8p8 was released in June. The latest version addresses the following:

• 1 HIGH severity vulnerability that only affects Windows

• 2 MEDIUM severity vulnerabilities

• 2 MEDIUM/LOW severity vulnerabilities

• 5 LOW severity vulnerabilities

• 28 non-security fixes and improvements

All of the security issues in this release are included in VU#633847.

• Sec 3119 / CVE-2016-9311: Trap crash

• Sec 3118 / CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector

• Sec 3114 / CVE-2016-7427: Broadcast Mode Replay Prevention DoS

• Sec 3113 / CVE-2016-7428: Broadcast Mode Poll Interval Enforcement DoS

• Sec 3110 / CVE-2016-9312: Windows: ntpd DoS by oversized UDP packet

• Sec 3102 / CVE-2016-7431: Regression: 010-origin: Zero Origin Timestamp Bypass

• Sec 3082 / CVE-2016-7434: Null pointer dereference in _IO_str_init_static_internal()

• Sec 3072 / CVE-2016-7429: Interface selection attack

• Sec 3071 / CVE-2016-7426: Client rate limiting and server responses

• Sec 3067 / CVE-2016-7433: Reboot sync calculation problem

Timeline:

• 20161121 Public release

• 20161118 Updated NEWS file

• 20161115 CERT notified

• 20161114 NTP Consortium Partner and Premier level members received access to patches

We would have preferred to give much more notice to our members and CERT, however, NTF’s NTP project remains severely under-funded. Google was unable to sponsor us this year and, currently, the Linux Foundation’s Core Internet Initiative only supports Harlan for about 25% of his hours per week and is restricted to NTP development only. We sincerely appreciate the support of our members and donors; much more support is needed to continue to improve NTP, complete the Network Time Security (NTS) project, continue our standards work, improve documentation, start on General Timestamp API and so much more. If accurate, secure time is important to you or your organization, help us help you: Donate today or become a member. Thank you!