[X] My Assistant

[CubeIt]

Now we have the NTP (network time protocol) vulnerability, but it is possible to compile the new code (version 4.2.8) for the Mac
http://www.macissues.com/2014/12/24/how-to...-10-6-and-10-7/
This also works for 10.5 PPC, and I have attempted to make an installer for these files using XCode's PackageMaker; but use at your own risk.

Run ntpd --version in the terminal window to see what version is currently installed.

The installer itself is further down.
http://www.cubeowner.com/forums/index.php?...st&p=104504

This post has been edited by CubeIt: Jan 21 2015, 09:38 PM

[jjgd]

Thanks, but where is the link for the advertised 10.5 installer ?
Also, I tried "ntpd --version" from Terminal, but it returns nothing.
And "what /usr/sbin/ntpd" returns "-bash: what: command not found" : ?

[jbarley]

I just ran "ntpd --version" and mine returns 4.2.6
I'd also be interested in a link to your installer package.

This post has been edited by jbarley: Dec 31 2014, 02:26 AM

[CubeIt]

Here it is; please report any problems so I might try and fix them. While I have had no troubles, this is 'use at your own risk' so make a backup of the system before trying it.

Again, just to be clear, all I did was compile the NTP code and make an installer of the resulting files; I didn't do any of the real work.


P.S. I have removed the attachment as it is superseded below

This post has been edited by CubeIt: Jan 3 2015, 09:17 PM

[jjgd]

Thanks a lot CubeIt, it works !
And "ntpd --version" which previously returned nothing in Terminal now returns : "ntpd 4.2.8@1.3265-o Tue Dec 30 10:14:07 UTC 2014 (1)"

Question : would the same installer work on an Intel Snow Leopard Mac ?
Or is it limited to Leopard/PPC ??

[CubeIt]

The Snow Leopard (Intel) installer you are looking for was done by another person (flatsixracer) and is at
https://discussions.apple.com/message/27347...tart=0#27347474
Mine is limited to 10.5.

Be very careful, as this Intel installer will happily install on a PPC Mac running 10.5, which it should not.

This post has been edited by CubeIt: Jan 3 2015, 09:18 PM

[CubeIt]

Things are still in flux as NTP issued (2nd Jan 2015) a beta 3 of patch 1 for 4.2.8
http://support.ntp.org/bin/view/Main/SoftwareDownloads

I take this as an excuse to introduce a universal installer. For those inquisitive the terminal command to combine PowerPC and Intel binaries into one Universal binary is

• lipo -create <file1> <file2> <...> -output <file>

I got the Intel binaries from the installer by flatsixracer but have not tested things on an Intel Mac running 10.5, just a PPC Mac (the PPC binaries I got by compiling the NTP code).

Use at your own risk

The simplest way to revert seems to be to reinstall the MacOSXUpdCombo10.5.8 package; this will also revert Bash, and that installer is at
http://forums.macrumors.com/showpost.php?p...p;postcount=120


P.S. To determine what sort of binary one has, Get Info returns the Kind which for a binary will be one of the following

• Unix Executable File
• Unix Executable File (Intel)
• Unix Executable File (PowerPC)
• Unix Executable File (Universal)

This post has been edited by CubeIt: Jan 21 2015, 09:35 PM

[CubeIt]

I am no longer sure this installer is ready for prime time, so I have removed it; even Apple did not go with NTP 4.2.8 for the fix; perhaps this should have been a warning.

Remember, the simplest way to revert seems to be to reinstall the MacOSXUpdCombo10.5.8 package; this will also revert any Bash patch.

This post has been edited by CubeIt: Jan 23 2015, 03:46 PM

[CubeIt]

Just to say, the problem is still being worked on

https://discussions.apple.com/message/27567...123456#27567718

[CubeIt]

I return to this now and again, and for now I have a PPC installer (not universal) that seems to work even better than the one before. Rather than attach it and keep on changing things, I can send the 'day's version' to anyone who might be interested.

[CubeIt]

The same people that did the Bash patch now have NTP files for 10.5 (PPC only)

http://tenfourfox.blogspot.com/2014/12/tim...me-of-ntpd.html

I have made an installer for these binaries, having tried them for 10.5.8; as always 'use at your own risk'

This post has been edited by CubeIt: Feb 5 2015, 04:24 PM

[CubeIt]

A later version is out 4.2.8p1; normally I would not bother, but the news files states

"vallen is not validated in several places in ntp_crypto.c, leading
to a potential information leak or possibly a crash

...

Affects: All NTP4 releases before 4.2.8p1, under at least some
versions of MacOS and Linux."


This patcher is PPC only, and as always 'use at your own risk'

This post has been edited by CubeIt: Mar 10 2015, 03:47 AM

[CubeIt]

An anonymous person has developed a script to build an installer; but the resulting size is too large to attach even when zipped. So far 4.3.8 is the latest build.

This post has been edited by CubeIt: Mar 15 2015, 11:29 AM