Ubuntu 17.04: USN-3349-1 Critical: NTP Denial Of Service Threats

ubuntu

July 5, 2017

Several security issues were fixed in NTP.

Summary

Several security issues were fixed in NTP.

Software Description:

- ntp: Network Time Protocol daemon and utility programs

Details:

Yihan Lian discovered that NTP incorrectly handled certain large request

data values. A remote attacker could possibly use this issue to cause NTP

to crash, resulting in a denial of service. This issue only affected

Ubuntu 16.04 LTS. (CVE-2016-2519)

Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed

addresses when performing rate limiting. A remote attacker could possibly

use this issue to perform a denial of service. This issue only affected

Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7426)

Matthew Van Gundy discovered that NTP incorrectly handled certain crafted

broadcast mode packets. A remote attacker could possibly use this issue to

perform a denial of service. This issue only affected Ubuntu 14.04 LTS,

Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7427, CVE-2016-7428)

Miroslav ...

Read the Full Advisory

Topics Covered

security advisory denial of service software update ubuntu ntp service threat

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  ntp                             1:4.2.8p9+dfsg-2ubuntu1.1

Ubuntu 16.10:
  ntp                             1:4.2.8p8+dfsg-1ubuntu2.1

Ubuntu 16.04 LTS:
  ntp                             1:4.2.8p4+dfsg-3ubuntu5.5

Ubuntu 14.04 LTS:
  ntp                             1:4.2.6.p5+dfsg-3ubuntu2.14.04.11

In general, a standard system update will make all the necessary changes.