Scientific Linux alert SLSA-2016:0063-1 (ntp)

From:
    	     
 
Pat Riehecky <riehecky@fnal.gov> 
To:
    	     
 
<scientific-linux-errata@listserv.fnal.gov> 
Subject:
    	     
 
Security ERRATA Important: ntp on SL6.x, SL7.x i386/x86_64 
Date:
    	     
 
Mon, 25 Jan 2016 14:53:10 +0000
Message-ID:
    	     
 
<20160125145310.3053.97392@slpackages.fnal.gov>
Synopsis:          Important: ntp security update
Advisory ID:       SLSA-2016:0063-1
Issue Date:        2016-01-25
CVE Numbers:       CVE-2015-8138
--

It was discovered that ntpd as a client did not correctly check the
originate timestamp in received packets. A remote attacker could use this
flaw to send a crafted packet to an ntpd client that would effectively
disable synchronization with the server, or push arbitrary offset/delay
measurements to modify the time on the client. (CVE-2015-8138)

After installing the update, the ntpd daemon will restart automatically.
--

SL6
  x86_64
    ntp-4.2.6p5-5.el6_7.4.x86_64.rpm
    ntp-debuginfo-4.2.6p5-5.el6_7.4.x86_64.rpm
    ntpdate-4.2.6p5-5.el6_7.4.x86_64.rpm
    ntp-perl-4.2.6p5-5.el6_7.4.x86_64.rpm
  i386
    ntp-4.2.6p5-5.el6_7.4.i686.rpm
    ntp-debuginfo-4.2.6p5-5.el6_7.4.i686.rpm
    ntpdate-4.2.6p5-5.el6_7.4.i686.rpm
    ntp-perl-4.2.6p5-5.el6_7.4.i686.rpm
  noarch
    ntp-doc-4.2.6p5-5.el6_7.4.noarch.rpm
SL7
  x86_64
    ntp-4.2.6p5-22.el7_2.1.x86_64.rpm
    ntp-debuginfo-4.2.6p5-22.el7_2.1.x86_64.rpm
    ntpdate-4.2.6p5-22.el7_2.1.x86_64.rpm
    sntp-4.2.6p5-22.el7_2.1.x86_64.rpm
  noarch
    ntp-doc-4.2.6p5-22.el7_2.1.noarch.rpm
    ntp-perl-4.2.6p5-22.el7_2.1.noarch.rpm

- Scientific Linux Development Team