Moderate: ntp security update (Amazon Linux 2)

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2017-6464: A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. 1433987: CVE-2017-6464 ntp: Denial of Service via Malformed Config CVE-2017-6463: A vulnerability was discovered in the NTP server's parsing of configuration directives. A remote, authenticated attacker could cause ntpd to crash by sending a crafted message. 1434002: CVE-2017-6463 ntp: Authenticated DoS via Malicious Config Option CVE-2017-6462: A vulnerability was found in NTP, in the parsing of packets from the /dev/datum device. A malicious device could send crafted messages, causing ntpd to crash. 1433995: CVE-2017-6462 ntp: Buffer Overflow in DPTS Clock CVE-2016-9311: A flaw was found in the way ntpd implemented the trap service. A remote attacker could send a specially crafted packet to cause a null pointer dereference that will crash ntpd, resulting in a denial of service. 1398350: CVE-2016-9311 ntp: Null pointer dereference when trap service is enabled CVE-2016-9310: A flaw was found in the control mode functionality of ntpd. A remote attacker could send a crafted control mode packet which could lead to information disclosure or result in DDoS amplification attacks. 1397319: CVE-2016-9310 ntp: Mode 6 unauthenticated trap information disclosure and DDoS vector CVE-2016-7433: A flaw was found in the way ntpd calculated the root delay. A remote attacker could send a specially-crafted spoofed packet to cause denial of service or in some special cases even crash. 1397347: CVE-2016-7433 ntp: Broken initial sync calculations regression CVE-2016-7429: A flaw was found in the way ntpd running on a host with multiple network interfaces handled certain server responses. A remote attacker could use this flaw which would cause ntpd to not synchronize with the source. 1397341: CVE-2016-7429 ntp: Attack on interface selection CVE-2016-7426: It was found that when ntp is configured with rate limiting for all associations the limits are also applied to responses received from its configured sources. A remote attacker who knows the sources can cause a denial of service by preventing ntpd from accepting valid responses from its sources. 1397345: CVE-2016-7426 ntp: Client rate limiting and server responses