Notified:  October 26, 2009 Updated: December 13, 2009

Statement Date:   December 02, 2009

Status

Affected

Vendor Statement

Please find below our bug id details: Cisco IOS and Cisco IOS XE Software (Cisco Bug ID: CSCtd75033) Cisco Nexus Series Switches (Cisco Bug IDs: CSCsz81239, CSCtd15613, CSCtd15613) Cisco Application Control Engine appliance (Cisco Bug ID: CSCsz93757) Cisco Unified Communications Manager - Linux (Cisco Bug ID: CSCtc99277) Cisco Telepresence Systems (Cisco Bug ID: CSCtc99290) Cisco Wide Area Application Services (WAAS) (Cisco Bug ID: CSCtc99299) Cisco Meeting Place Server (Cisco Bug ID: CSCtc99306) Cisco Mobility Services Engine (Location Appliance) (Cisco Bug ID: CSCtc99318) Cisco ACE XML Gateways (Cisco Bug ID: CSCtd15631) Cisco IP Interoperability and Communications System (IPICS) (Cisco Bug ID: CSCtd15623) Cisco MDS 9500 Series (Cisco Bug ID: CSCtd15595) Cisco Digital Media Players (Cisco Bug ID: CSCtd15641)

Vendor Information

Please see Cisco Vulnerability Alert 19540.

Vendor References

• http://tools.cisco.com/security/center/viewAlert.x?alertId=19540

Notified:  October 26, 2009 Updated: December 10, 2009

Statement Date:   December 10, 2009

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Please see: http://bugs.gentoo.org/show_bug.cgi?id=290881.

Vendor References

• http://bugs.gentoo.org/show_bug.cgi?id=290881

Updated:  December 16, 2009

Statement Date:   December 15, 2009

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

we announced on Friday that our LANTIME NTP Time Server Appliances are affected as well: http://www.meinberg.de/english/news/lantime-firmware-update-ntp-security-problem-with-mode-7-packets.htm Additionally, Meinberg provides an easy-to-use Windows installer for the reference implementation of NTP, i.e. we created an installer that installs the original ntpd from ntp.org on Windows machines. We also updated this installer to include 4.2.4p8 and nicknamed it "lennon" (in memory of the death of John Lennon, wo died on December 8th - the day when this vulnerability has been announced. http://www.meinberg.de/english/news/software-new-ntp-version-for-windows-4-2-4p8-security-update.htm

Notified:  October 26, 2009 Updated: December 07, 2009

Statement Date:   December 07, 2009

Status

Affected

Vendor Statement

The NTP feature of the Neutrino operating system (version 6.4.1 and earlier) is vulnerable. This issue will be corrected in the upcoming Neutrino 6.4.2 operating system release. Please contact your QNX representative regarding earlier OS product releases.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Notified:  October 26, 2009 Updated: January 22, 2010

Statement Date:   January 22, 2010

Status

Affected

Vendor Statement

Solaris is impacted by CERT Vulnerability Note VU#568372: 'NTP mode 7 denial-of-service vulnerability'. We have published Sun Alert 275590 for this issue. http://sunsolve.sun.com/search/document.do?assetkey=1-66-275590-1

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Vendor References

• http://sunsolve.sun.com/search/document.do?assetkey=1-66-275590-1

Notified:  October 26, 2009 Updated: December 09, 2009

Status

Affected

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Please see http://www.ubuntu.com/usn/USN-867-1.

Vendor References

• http://www.ubuntu.com/usn/USN-867-1