On Jan 7, 2015, at 12:01 PM, Bill Cheeseman <[email protected]> wrote: > Where did you get the idea that it includes everybody in the neighborhood?
I believe it was on Security Now. But right now I don’t see anything that says it is limited to local connections at all, so that may have been something else. <http://alblue.bandlem.com/2014/12/ntpd-osx.html> > "According to Apple, there is a remote exploit possibility due to a remote > buffer overrun in the ntpd program. It’s been given CVE-2014-9295 as a > designator, and lists that it’s network exploitable." <https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9295> > Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow > remote attackers to execute arbitrary code via a crafted packet, related to > (1) the crypto_recv function when the Autokey Authentication feature is used, > (2) the ctl_putdata function, and (3) the configure function. > > CVSS Version 2 Metrics: > Access Vector: Network exploitable > Access Complexity: Low > Authentication: Not required to exploit > Impact Type: Allows unauthorized disclosure of information; Allows > unauthorized modification; Allows disruption of service <https://www.us-cert.gov/ncas/current-activity/2014/12/23/Apple-Releases-Security-Updates-OS-X> > Apple has released security updates for OS X Mountain Lion, Mavericks, and > Yosemite to address multiple vulnerabilities in the Network Time Protocol > daemon. Exploitation of these vulnerabilities may allow a remote attacker to > take control of a vulnerable system. -- Love is like oxygen / You get too much / you get too high / Not enough and you're gonna die _______________________________________________ MacOSX-talk mailing list [email protected] http://www.omnigroup.com/mailman/listinfo/macosx-talk
