Skip to content
OpenAdvisories
Medium ELSA-2017-0252 5 CVEs

Moderate: ntp security update (Oracle Linux 7)

Published Feb 6, 2017 · Updated Feb 6, 2017

Ecosystem: Oracle Linux

Summary

[4.2.6p5-25.0.1.el7_3.1]
- Bump release to avoid ULN conflict with Oracle modified errata.

[4.2.6p5-25.el7_3.1]
- don't limit rate of packets from sources (CVE-2016-7426)
- don't change interface from received packets (CVE-2016-7429)
- fix calculation of root distance again (CVE-2016-7433)
- require authentication for trap commands (CVE-2016-9310)
- fix crash when reporting peer event to trappers (CVE-2016-9311)

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 7 ntp 0:4.2.6p5-25.0.1.el7_3.1
Oracle Linux · 7 ntp-doc 0:4.2.6p5-25.0.1.el7_3.1
Oracle Linux · 7 ntp-perl 0:4.2.6p5-25.0.1.el7_3.1
Oracle Linux · 7 ntpdate 0:4.2.6p5-25.0.1.el7_3.1
Oracle Linux · 7 sntp 0:4.2.6p5-25.0.1.el7_3.1

Vulnerabilities 5

  • Unscored —
    CVE-2016-7426 EPSS 12%

    NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations i…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-7429

    NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows rem…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-7433

    NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecifie…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-9310 EPSS 11%

    The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via…

    ntp ntp Debian Ubuntu
  • Unscored —
    CVE-2016-9311 EPSS 11%

    ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NUL…

    ntp ntp Debian Ubuntu