Scientific Linux 6/7: SLSA-2016:0063-1 Critical NTP Security Issue

Date: Mon, 25 Jan 2016 14:53:10 +0000
Reply-To: scientific-linux-users@
Sender: Security Errata for Scientific Linux
 
From: Pat Riehecky 
Subject: Security ERRATA Important: ntp on SL6.x, SL7.x i386/x86_64
MIME-Version: 1.0
Message-ID: <20160125145310.3053.97392@slpackages.fnal.gov>

Synopsis: Important: ntp security update
Advisory ID: SLSA-2016:0063-1
Issue Date: 2016-01-25
CVE Numbers: CVE-2015-8138
--

It was discovered that ntpd as a client did not correctly check the
originate timestamp in received packets. A remote attacker could use this
flaw to send a crafted packet to an ntpd client that would effectively
disable synchronization with the server, or push arbitrary offset/delay
measurements to modify the time on the client. (CVE-2015-8138)

After installing the update, the ntpd daemon will restart automatically.
--

SL6
 x86_64
 ntp-4.2.6p5-5.el6_7.4.x86_64.rpm
 ntp-debuginfo-4.2.6p5-5.el6_7.4.x86_64.rpm
 ntpdate-4.2.6p5-5.el6_7.4.x86_64.rpm
 ntp-perl-4.2.6p5-5.el6_7.4.x86_64.rpm
 i386
 ntp-4.2.6p5-5.el6_7.4.i686.rpm
 ntp-debuginfo-4.2.6p5-5.el6_7.4.i686.rpm
 ntpdate-4.2.6p5-5.el6_7.4.i686.rpm
 ntp-perl-4.2.6p5-5.el6_7.4.i686.rpm
 noarch
 ntp-doc-4.2.6p5-5.el6_7.4.noarch.rpm
SL7
 x86_64
 ntp-4.2.6p5-22.el7_2.1.x86_64.rpm
 ntp-debuginfo-4.2.6p5-22.el7_2.1.x86_64.rpm
 ntpdate-4.2.6p5-22.el7_2.1.x86_64.rpm
 sntp-4.2.6p5-22.el7_2.1.x86_64.rpm
 noarch
 ntp-doc-4.2.6p5-22.el7_2.1.noarch.rpm
 ntp-perl-4.2.6p5-22.el7_2.1.noarch.rpm

- Scientific Linux Development Team