Stay Secure with the Latest Linux Advisories

security advisorycriticalFedora

Fedora: 2005-812 Important: Ntp 4.2.0.a Gid Vulnerability Patch Update

When starting xntpd with the -u option and specifying the group by using a string not a numeric gid the daemon uses the gid of the user not the group. This problem is now fixed by this update.. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-812 2005-08-26 ---------------------------------------------------------------------Product : Fedora Core 3 Name : ntp Version : 4.2.0.a.20040617 Release : 5.FC3 Summary : Synchronizes system time using the Network Time Protocol (NTP). Description : The Network Time Protocol (NTP) is used to synchronize a computer's time with another reference time source. The ntp package contains utilities and daemons that will synchronize your computer's time to Coordinated Universal Time (UTC) via the NTP protocol and NTP servers. The ntp package includes ntpdate (a program for retrieving the date and time from remote machines via a network) and ntpd (a daemon which continuously adjusts system time). Install the ntp package if you need tools for keeping your system's time synchronized via the NTP protocol. ---------------------------------------------------------------------Update Information: When starting xntpd with the -u option and specifying the group by using a string not a numeric gid the daemon uses the gid of the user not the group. This problem is now fixed by this update. The Common Vulnerabilities and Exposures project assigned the name CAN-2005-2496 to this issue. ---------------------------------------------------------------------* Fri Aug 26 2005 Jindrich Novy 4.2.0.a.20040617-5.FC3 - release update to fix CAN-2005-2496 (#147743) * Thu Apr 14 2005 Jiri Ryska - 4.2.0.a.20040617-4.FC3 - fixed gid setting when ntpd started with -u flag ---------------------------------------------------------------------This update can be downloaded from: 8ffa25a375fde2490f9066094f9b963a SRPMS/ntp-4.2.0.a.20040617-5.FC3.src.rpm a1df48b304321dcab2d50d1ab7ad490c x86_64/ntp-4.2.0.a.20040617-5.FC3.x86_64.rpm c90cc76e4a237216e1fa73099a7784f4 x86_64/debug/ntp-debuginfo-4.2.0.a.20040617-5.FC3.x86_64.rpm 19f969758a759187854a4082f939ca09 i386/ntp-4.2.0.a.20040617-5.FC3.i386.rpm 6c0067db4f0f98903d8107dee90f78ce i386/debug/ntp-debuginfo-4.2.0.a.20040617-5.FC3.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. ----------------------------------------------------------------------- fedora-announce-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Resolve the gid issue with xntpd in Fedora Core 3 NTP by ensuring proper group permissions. Check gid, modify if needed, update configs, and restart the service. ntp package,Fedora Core,time synchronization,network time protocol,xntpd daemon. . Severity: Important. LinuxSecurity.com Team

Aug 26, 2005 •Important Fedora