Network Time Protocol daemon (ntpd) Multiple Vulnerabilities

Multiple vulnerabilities were identified in ntpd, which could be exploited by a remote user to cause denial of service conditions and bypass authentication on the target system.

1. A remote user with knowledge of a symmetric association between two hosts can periodically send a specially crafted packet to one host of the symmetric association to cause both hosts to fail to synchronize.
2. When configured for symmetric key authentication, the system accepts packets that do not contain a message authentication code (MAC) as valid packets. A remote user with the ability to conduct a man-in-the-middle attack can send a specially crafted spoofed packet that does not contain a MAC value to bypass authentication. Authentication using autokey is not affected.