Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Ubuntu 16.04 LTS USN-3096-1 DoS Threats Resolved for NTP

ubuntu
Calendar Grey October 5, 2016
Scroller Ubuntu
Multiple security flaws in NTP have been addressed in Ubuntu versions 16.04, 14.04, and 12.04 to mitigate risks and bolster protection.
Several security issues were fixed in NTP.

Summary

Several security issues were fixed in NTP.

Software Description:

- ntp: Network Time Protocol daemon and utility programs

Details:

Aanchal Malhotra discovered that NTP incorrectly handled authenticated

broadcast mode. A remote attacker could use this issue to perform a replay

attack. (CVE-2015-7973)

Matt Street discovered that NTP incorrectly verified peer associations of

symmetric keys. A remote attacker could use this issue to perform an

impersonation attack. (CVE-2015-7974)

Jonathan Gardner discovered that the NTP ntpq utility incorrectly handled

memory. An attacker could possibly use this issue to cause ntpq to crash,

resulting in a denial of service. This issue only affected Ubuntu 16.04

LTS. (CVE-2015-7975)

Jonathan Gardner discovered that the NTP ntpq utility incorrectly handled

dangerous characters in filenames. An attacker could possibly use this

issue to overwrite arbitrary files. (CVE-2015-7976)

Stephen Gray discovered that NTP incorrectly...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory security issue DoS Ubuntu network time protocol

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  ntp                             1:4.2.8p4+dfsg-3ubuntu5.3

Ubuntu 14.04 LTS:
  ntp                             1:4.2.6.p5+dfsg-3ubuntu2.14.04.10

Ubuntu 12.04 LTS:
  ntp                             1:4.2.6.p3+dfsg-1ubuntu3.11

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-3096-1

CVE-2015-7973, CVE-2015-7974, CVE-2015-7975, CVE-2015-7976,

CVE-2015-7977, CVE-2015-7978, CVE-2015-7979, CVE-2015-8138,

CVE-2015-8158, CVE-2016-0727, CVE-2016-1547, CVE-2016-1548,

CVE-2016-1550, CVE-2016-2516, CVE-2016-2518, CVE-2016-4954,

CVE-2016-4955, CVE-2016-4956

Severity
critical
Lowest
Low
Medium
High
Critical

October 05, 2016

Topics%20covered

Topics Covered

security advisory security issue DoS Ubuntu network time protocol

Package Information

https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p4+dfsg-3ubuntu5.3
https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p5+dfsg-3ubuntu2.14.04.10
https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p3+dfsg-1ubuntu3.11

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.