Alerts This Week
Warning Icon 1 485
Alerts This Week
Warning Icon 1 485

Fedora 23: 2016-8bb1932088 Critical: NTP Denial Of Service Issue

fedora
Calendar Grey January 30, 2016
Dist Fedora Esm H88
A significant adjustment for Fedora 23’s network time protocol tackles several vital vulnerabilities, enhancing both security and system resilience.
Security fix for CVE-2015-7974, CVE-2015-8138, CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8158

Summary

The Network Time Protocol (NTP) is used to synchronize a computer's

time with another reference time source. This package includes ntpd

(a daemon which continuously adjusts system time) and utilities used

to query and configure the ntpd daemon.

Perl scripts ntp-wait and ntptrace are in the ntp-perl package,

ntpdate is in the ntpdate package and sntp is in the sntp package.

The documentation is in the ntp-doc package.

Update Information:

Security fix for CVE-2015-7974, CVE-2015-8138, CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8158

Topics%20covered

Topics Covered

security advisory denial of service fedora critical bug fix ntp

Change Log

References


[ 1 ] Bug #1297471 - CVE-2015-7974 ntp: missing key check allows impersonation between authenticated peers (VU#357792) https://bugzilla.redhat.com/show_bug.cgi?id=1297471 [ 2 ] Bug #1299442 - CVE-2015-8138 ntp: missing check for zero originate timestamp https://bugzilla.redhat.com/show_bug.cgi?id=1299442 [ 3 ] Bug #1300269 - CVE-2015-7977 ntp: restriction list NULL pointer dereference https://bugzilla.redhat.com/show_bug.cgi?id=1300269 [ 4 ] Bug #1300270 - CVE-2015-7978 ntp: stack exhaustion in recursive traversal of restriction list https://bugzilla.redhat.com/show_bug.cgi?id=1300270 [ 5 ] Bug #1300271 - CVE-2015-7979 ntp: off-path denial of service on authenticated broadcast mode https://bugzilla.redhat.com/show_bug.cgi?id=1300271 [ 6 ] Bug #1300273 - CVE-2015-8158 ntp: potential infinite loop in ntpq https://bugzilla.redhat.com/show_bug.cgi?id=1300273

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update ntp' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: ntp
Product: Fedora 23
Version: 4.2.6p5
Release: 36.fc23
URL: http://www.ntp.org
Summary: The NTP daemon and utilities

Topics%20covered

Topics Covered

security advisory denial of service fedora critical bug fix ntp

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here