Instead of disabling ntpd, you should download the source for version 4.2.8 of ntp and compile it yourself. All you need is Xcode for Lion/SnowLeo. It should work on 10.6.x and 10.7.x just fine.
I have updated my 10.10 install immediately after the CVE was made public and source code released and I didn't wait on Apple to release the update.
To compile ntpd, download the source from ntp.org and apply the patch for OS X/FreeBSD. After applying this patch, you will be able to just run "./configure && make." Then you can copy the binaries to appropriate directories (/usr/sbin/ and /usr/bin/).
For Mac OS X 10.7 (Lion):
curl http://www.eecis.udel.edu/~ntp/ntp_spool/ntp4/ntp-4.2/ntp-4.2.8.tar.gz | tar zxf -
curl http://bugs.ntp.org/attachment.cgi?id=1165 | patch -p1
./configure && make
Here's the list of files and folders to which they belong to that will be built from the source above. After compilation, all these files will be in various sub-folders.
Rename old ones using something like:
sudo mv /usr/sbin/ntpd /usr/sbin/ntpd.old
and then move the new one in. Make sure to chown the files after moving them in place:
sudo chown root:wheel /usr/sbin/ntpd
Note: I did not use
sudo make install because I didn't trust the Makefile (I wasn’t sure it would place files in the same folders that Apple has originally placed them in and wanted to be sure they're still in the same spot as old ones). Manually moving 6 files is not a big issue. Rest of the files (man pages, html pages, etc are the same so you don't have to bother moving those.)
securityfeedback entry yet :(.