NTP < 4.2.8p3 DoS Vulnerability

Under limited and specific circumstances an attacker can send a crafted packet to cause a vulnerable ntpd instance to crash. This requires each of the following to be true: - ntpd set up to allow for remote configuration (not allowed by default), and - knowledge of the configuration password, and - access to a computer entrusted to perform remote configuration.

Please see the references for more information on the vulnerabilities.

NTPd version prior to 4.2.8p3, 4.3.x prior to version 4.3.25.

Checks if a vulnerable version is present on the target host.

Update to version 4.2.8p3, 4.3.25 or later.