Scientific Linux: SLSA-2015:1930-1 Important NTP DoS Threat

Date: Mon, 26 Oct 2015 22:44:28 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Important: ntp on SL6.x, SL7.x i386/x86_64
MIME-Version: 1.0
Message-ID: <20151026224428.31410.69094@slpackages.fnal.gov>

Synopsis: Important: ntp security update
Advisory ID: SLSA-2015:1930-1
Issue Date: 2015-10-26
CVE Numbers: CVE-2015-7704
 CVE-2015-5300
--

It was discovered that ntpd as a client did not correctly check timestamps
in Kiss-of-Death packets. A remote attacker could use this flaw to send a
crafted Kiss-of-Death packet to an ntpd client that would increase the
client's polling interval value, and effectively disable synchronization
with the server. (CVE-2015-7704)

It was found that ntpd did not correctly implement the threshold
limitation for the '-g' option, which is used to set the time without any
restrictions. A man-in-the-middle attacker able to intercept NTP traffic
between a connecting client and an NTP server could use this flaw to force
that client to make multiple steps larger than the panic threshold,
effectively changing the time to an arbitrary value. (CVE-2015-5300)

After installing the update, the ntpd daemon will restart automatically.
--

SL6
 x86_64
 ntp-4.2.6p5-5.el6_7.2.x86_64.rpm
 ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
 ntpdate-4.2.6p5-5.el6_7.2.x86_64.rpm
 ntp-perl-4.2.6p5-5.el6_7.2.x86_64.rpm
 i386
 ntp-4.2.6p5-5.el6_7.2.i686.rpm
 ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
 ntpdate-4.2.6p5-5.el6_7.2.i686.rpm
 ntp-perl-4.2.6p5-5.el6_7.2.i686.rpm
 noarch
 ntp-doc-4.2.6p5-5.el6_7.2.noarch.rpm
SL7
 x86_64
 ntp-4.2.6p5-19.el7_1.3.x86_64.rpm
 ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
 ntpdate-4.2.6p5-19.el7_1.3.x86_64.rpm
 sntp-4.2.6p5-19.el7_1.3.x86_64.rpm
 noarch
 ntp-doc-4.2.6p5-19.el7_1.3.noarch.rpm
 ntp-perl-4.2.6p5-19.el7_1.3.noarch.rpm

- Scientific Linux Development Team