4.2.8p2 Release Announcement

Last update: June 28, 2022 21:06 UTC (1f97faf40)

NTF’s NTP Project has been notified of two vulnerabilities in the processing of crafted packets using private key authentication. These issues were discovered and reported by Miroslav Lichvar of Red Hat.

• 2779: ntpd accepts unauthenticated packets with symmetric key crypto / CVE-2015-1798
• 2781: Authentication doesn’t protect symmetric associations against DoS attacks / CVE-2015-1799

The fixes for these issues (along with other bugfixes and improvements) was released on 7 April 2015 in ntp-4.2.8p2.

---

Timeline:

• 2015 Apr 7: Public release
• 2015 Mar 29: pre-release patch availability announced to CERT
• 2015 Mar 22: Early Access Program Release: Premier and Partner Institutional Members
• 2015 Mar 17: CERT notified and CVSS scoring collaboration requested
• 2015 Mar 15: Notification to Institutional Members
• 2015 Mar 6: Initial notification received; analysis begins