Oval Definition:oval:com.redhat.rhsa:def:20142024
Revision Date:2014-12-20Version:639
Title:RHSA-2014:2024: ntp security update (Important)
Description:The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

  • Multiple buffer overflow flaws were discovered in ntpd's crypto_recv(), ctl_putdata(), and configure() functions. A remote attacker could use either of these flaws to send a specially crafted request packet that could crash ntpd or, potentially, execute arbitrary code with the privileges of the ntp user. Note: the crypto_recv() flaw requires non-default configurations to be active, while the ctl_putdata() flaw, by default, can only be exploited via local attackers, and the configure() flaw requires additional authentication to exploit. (CVE-2014-9295)

  • It was found that ntpd automatically generated weak keys for its internal use if no ntpdc request authentication key was specified in the ntp.conf configuration file. A remote attacker able to match the configured IP restrictions could guess the generated key, and possibly use it to send ntpdc query or configuration requests. (CVE-2014-9293)

  • It was found that ntp-keygen used a weak method for generating MD5 keys. This could possibly allow an attacker to guess generated MD5 keys that could then be used to spoof an NTP client or server. Note: it is recommended to regenerate any MD5 keys that had explicitly been generated with ntp-keygen; the default installation does not contain such keys). (CVE-2014-9294)

  • A missing return statement in the receive() function could potentially allow a remote attacker to bypass NTP's authentication mechanism. (CVE-2014-9296)

    All ntp users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. After installing the update, the ntpd daemon will restart automatically.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2014-9293
    CVE-2014-9294
    CVE-2014-9295
    CVE-2014-9296
    RHSA-2014:2024
    RHSA-2014:2024-00
    RHSA-2014:2024-02
    Platform(s):Red Hat Enterprise Linux 6
    Red Hat Enterprise Linux 7
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 7 is installed
  • AND
  • ntp is earlier than 0:4.2.6p5-19.el7_0
  • AND ntp is signed with Red Hat redhatrelease2 key
  • ntp-doc is earlier than 0:4.2.6p5-19.el7_0
  • AND ntp-doc is signed with Red Hat redhatrelease2 key
  • ntp-perl is earlier than 0:4.2.6p5-19.el7_0
  • AND ntp-perl is signed with Red Hat redhatrelease2 key
  • ntpdate is earlier than 0:4.2.6p5-19.el7_0
  • AND ntpdate is signed with Red Hat redhatrelease2 key
  • sntp is earlier than 0:4.2.6p5-19.el7_0
  • AND sntp is signed with Red Hat redhatrelease2 key
  • OR Package Information
  • Red Hat Enterprise Linux 6 is installed
  • AND
  • ntp is earlier than 0:4.2.6p5-2.el6_6
  • AND ntp is signed with Red Hat redhatrelease2 key
  • ntp-doc is earlier than 0:4.2.6p5-2.el6_6
  • AND ntp-doc is signed with Red Hat redhatrelease2 key
  • ntp-perl is earlier than 0:4.2.6p5-2.el6_6
  • AND ntp-perl is signed with Red Hat redhatrelease2 key
  • ntpdate is earlier than 0:4.2.6p5-2.el6_6
  • AND ntpdate is signed with Red Hat redhatrelease2 key
  • BACK