Safran – Timing Support Bulletins

A certain type of message without a data payload after a long idle period such as a reboot (such as a power management enable signal) from a computer’s PCI express controller to the Spectracom TSync-PCIe timing card can prevent the OS from booting up, or cause the card to ‘disappear’ from the OS

Spectracom disables NTP queries by default so is not at risk for the vulnerability described in CVE-2013-5211. However we recommend you verify the NTP server has not been configured to allow queries or you have adequate network security to reduce the risk of an attack due to monlist

Spectracom products running LINUX are only susceptible if an attacker is able to successfully authenticate with the product and gain shell access. This Linux vulnerability can only be exploited if an attacker is able to successfully authenticate with the product and gain shell access. We eliminated the vulnerability in the 5.7.0 release for SecureSync and NetClock 9400.

When performing a software upgrade, a SecureSync or NetClock 9400 requires additional disk space. It is recommended to ensure memory usage is less than 70% before upgrading. If memory usage is more than 70%, save and delete logs and previous update files

The IP address will be displayed on the front panel as 0.0.0.0 (as shown below) and also in the Web User Interface (UI), if the Ethernet port is not connected to a network hub, switch or a stand-alone PC.

When GPS started broadcasting the leap second notification on July 19, 2016 for activation on Dec 31, some GPS timing receivers erroneously inserted the leap second resulting in a 1 second time error.

The vulnerability in Open SSL, known as the Heartbleed bug, makes some Spectracom products susceptible. A software patch fixes the bug. Alternatively network access controls, shutting down the management port, and changing user passwords are mitigating actions.

SecureSync time and frequency synchronization system and NetClock 9400 time server/master clock contains a Lithium Battery for the purpose of providing power to the real time clock on the processor board.

Several vulnerabilities were recently reported in ntpd currently used in application software version 5.6.0 or below. The 5.7.0 release resolves these vulnerabilities with the update to NTP version 4.2.8p10.

Spectracom SecureSync and NetClock 9400 units need a certain amount of free space on its compact flash memory. A bug in version 5.0.2 continuously creates log entries during normal operation which over a long period of time will consume memory that will compromise correct operation of the unit.

Certificate of Volatility for Spectracom SecureSync 1200 SecureSync® Time & Frequency Reference Solution

Our SecureSync 1200 and NetClock 9400 line of products have an internal compact flash (CF) card which handles the day to day logging of critical operations within your appliance. As more and more operations occur and logging functions increase, CF cards can wear-out over time and require a replacement to maintain their logging capabilities.

New shipments of the SecureSync Time & Frequency Synchronization Platform, including NetClock 9400 Series Time Servers, include an upgraded version of the core processing module. The new version will provide users with faster processing speeds and enhanced memory functionality. The new processor requires at least version 5.7.0 of the firmware.

Certificate of Volatility for Spectracom SecureSync® Option Cards

Spectracom products are only susceptible if an attacker can successfully authenticate with the product and gain command line shell access. Malware is required to be run locally within the system to exploit these vulnerabilities. Spectracom recommends following good security practices, including applying software updates containing the latest security patches as they become available, and applying policies and settings that protect and limit access to authorized and trusted users. We are working to update our operating systems and software as they become available to resolve these potential vulnerabilities within the affected products. We will update this bulletin as new information becomes available.

Documentation is available for testing SAASM receivers when using a GNSS simulator.