| Revision Date: | 2017-02-06 | Version: | 638 |
| Title: | RHSA-2017:0252: ntp security update (Moderate) |
| Description: | The Network Time Protocol (NTP) is used to synchronize a computer's time with another referenced time source. These packages include the ntpd service which continuously adjusts system time and utilities used to query and configure the ntpd service.
Security Fix(es):
It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. (CVE-2016-7426)
A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. (CVE-2016-9310)
A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. (CVE-2016-9311)
A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. (CVE-2016-7429)
A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. (CVE-2016-7433)
|
| Family: | unix | Class: | patch |
| Status: | | Reference(s): | CVE-2016-7426
CVE-2016-7429
CVE-2016-7433
CVE-2016-9310
CVE-2016-9311
RHSA-2017:0252
RHSA-2017:0252-00
RHSA-2017:0252-01
RHSA-2017:0252-01
|
| Platform(s): | Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
| Product(s): | |
| Definition Synopsis |
| Red Hat Enterprise Linux must be installed OR Package Information
Red Hat Enterprise Linux 6 is installed
AND
ntp is earlier than 0:4.2.6p5-10.el6_8.2
AND ntp is signed with Red Hat redhatrelease2 key
ntp-doc is earlier than 0:4.2.6p5-10.el6_8.2
AND ntp-doc is signed with Red Hat redhatrelease2 key
ntp-perl is earlier than 0:4.2.6p5-10.el6_8.2
AND ntp-perl is signed with Red Hat redhatrelease2 key
ntpdate is earlier than 0:4.2.6p5-10.el6_8.2
AND ntpdate is signed with Red Hat redhatrelease2 key
OR Package Information
Red Hat Enterprise Linux 7 is installed
AND
ntp is earlier than 0:4.2.6p5-25.el7_3.1
AND ntp is signed with Red Hat redhatrelease2 key
ntp-doc is earlier than 0:4.2.6p5-25.el7_3.1
AND ntp-doc is signed with Red Hat redhatrelease2 key
ntp-perl is earlier than 0:4.2.6p5-25.el7_3.1
AND ntp-perl is signed with Red Hat redhatrelease2 key
ntpdate is earlier than 0:4.2.6p5-25.el7_3.1
AND ntpdate is signed with Red Hat redhatrelease2 key
sntp is earlier than 0:4.2.6p5-25.el7_3.1
AND sntp is signed with Red Hat redhatrelease2 key
|