Upstream has announced several new security issues on October 21: http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner Apparently all of the issues don't affect 4.2.6, as Fedora has only patched: - check origin timestamp before accepting KoD RATE packet (CVE-2015-7704) - allow only one step larger than panic threshold with -g (CVE-2015-5300) - fix memory leak with autokey (CVE-2015-7701) - don't crash with crafted autokey packet (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702) - don't crash in ntpq with crafted packet (CVE-2015-7852) - don't mobilize passive association with crypto NAK (CVE-2015-7871) They also fixed the dependencies of ntpdate.service, which should prevent it trying to start too early and failing. More info on the security issues: https://www.cs.bu.edu/~goldbe/NTPattack.html Patched packages uploaded for Mageia 5 and Cauldron. I'll update the advisory with a Fedora advisory link once it's available. It is currently assigned to QA: https://bodhi.fedoraproject.org/updates/FEDORA-2015-de44abca87 Advisory: ======================== Updated ntp packages fix security vulnerabilities: It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. A man-in-the-middle attacker able to intercept NTP traffic between a connecting client and an NTP server could use this flaw to force that client to make multiple steps larger than the panic threshold, effectively changing the time to an arbitrary value at any time (CVE-2015-5300). Slow memory leak in CRYPTO_ASSOC with autokey (CVE-2015-7701). Incomplete autokey data packet length checks could result in crash caused by a crafted packet (CVE-2015-7691, CVE-2015-7692, CVE-2015-7702). Clients that receive a KoD should validate the origin timestamp field (CVE-2015-7704). ntpq atoascii() Memory Corruption Vulnerability could result in ntpd crash caused by a crafted packet (CVE-2015-7852). Symmetric association authentication bypass via crypto-NAK (CVE-2015-7871). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5300 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7691 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7692 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7701 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7702 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7852 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7871 http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner ======================== Updated packages in core/updates_testing: ======================== ntp-4.2.6p5-24.2.mga5 ntp-client-4.2.6p5-24.2.mga5 ntp-doc-4.2.6p5-24.2.mga5 from ntp-4.2.6p5-24.2.mga5.src.rpm Reproducible: Steps to Reproduce:
Version: Cauldron => 5
Working fine on our main server here at work, Mageia 5 i586.
Whiteboard: (none) => MGA5-32-OK
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugsWhiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK advisory
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2015-0413.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED
LWN reference for CVE-2015-5300: http://lwn.net/Vulnerabilities/662065/
Your article is very good and attractive. It's great to sip your morning coffee and read a high-quality article like this https://wordleplay.io . Thanks a lot
CC: (none) => liamhellen55
Find a wide determination of first-class bike suits for your riding closet. motorcycle racing suit https://milogears.com/en-us/products/copy-of-gear-up-for-the-ride-with-our-wide-selection-of-replica-motorcycle-suits-perfect-for-racing-riding-one-and-two-piece-high-quality-leather-suit
CC: (none) => alinomi07
CC: alinomi07, liamhellen55 => (none)