Secunia

A vulnerability has been reported in NTP, which can be exploited by malicious people to potentially compromise a user's system.

The vulnerability is caused due to a boundary error within the "cookedprint()" function in ntpq/ntpq.c. This can be exploited to cause a stack-based buffer overflow with two bytes via a specially crafted server response.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into querying a malicious time server with ntpq.

The vulnerability is reported in version 4.2.4p6. Other versions may also be affected.

Solution
Update to version 4.2.4p7.

Provided and/or discovered by
Apple Product Security

Changelog
Further details available in Customer Area

Original Advisory
https://support.ntp.org/bugs/show_bug.cgi?id=1144
https://lists.ntp.org/pipermail/announce/2009-May/000062.html

Deep Links
Links available in Customer Area