Description of problem:

Issue 1: Buffer overflow in ntpdate.c

ntpdate.c includes the following code (lines 613-619):
		if (!authistrusted(sys_authkey)) {
			char buf[10];

			(void) sprintf(buf, "%lu", (unsigned long)sys_authkey);
			msyslog(LOG_ERR, "authentication key %s unknown", buf);
			exit(1);
		}

Assumping a 32 bit system, the number of bytes required for buf is
1+(floor(32*ln(2)/ln(10)) = 10.
Adding one byte for the NULL, the declaration should 'char buf[11]'.

Issue 2: ntpd can write to ntpdate's configuration file.

It's a bad idea for programs to be able to write to their own configuration
files - this can expose quite subtle privilege escalation attacks. A more secure
filesystem layout would be:

drwxr-xr-x   root     root  /etc/ntp
-rw-r--r--   root     root  /etc/ntp/ntp.conf
-rw-r--r--   root     root  /etc/ntp/step-tickers
-rw-r-----   root     ntp   /etc/ntp/keys
drwxr-xr-x   root     ntp   /etc/ntp/data
-rw-r--r--   ntp      ntp   /etc/ntp/data/drift

Version-Release number of selected component (if applicable): 4.1.1a-9