RHSA-2009:1040: Critical: ntp security update
First published: Mon May 18 2009(Updated: )
The Network Time Protocol (NTP) is used to synchronize a computer's time<br>with a referenced time source.<br>A buffer overflow flaw was discovered in the ntpd daemon's NTPv4<br>authentication code. If ntpd was configured to use public key cryptography<br>for NTP packet authentication, a remote attacker could use this flaw to<br>send a specially-crafted request packet that could crash ntpd or,<br>potentially, execute arbitrary code with the privileges of the "ntp" user.<br>(CVE-2009-1252)<br>Note: NTP authentication is not enabled by default.<br>A buffer overflow flaw was found in the ntpq diagnostic command. A<br>malicious, remote server could send a specially-crafted reply to an ntpq<br>request that could crash ntpq or, potentially, execute arbitrary code with<br>the privileges of the user running the ntpq command. (CVE-2009-0159)<br>All ntp users are advised to upgrade to this updated package, which<br>contains backported patches to resolve these issues. After installing the<br>update, the ntpd daemon will be restarted automatically.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/ntp | <4.2.0.a.20040617-8.el4_7.2 | 4.2.0.a.20040617-8.el4_7.2 |
| redhat/ntp | <4.2.0.a.20040617-8.el4_7.2 | 4.2.0.a.20040617-8.el4_7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of RHSA-2009:1040?
The severity of RHSA-2009:1040 is classified as critical due to the potential for remote code execution.
How do I fix RHSA-2009:1040?
To fix RHSA-2009:1040, upgrade the ntp package to the latest version provided by Red Hat.
What software is affected by RHSA-2009:1040?
RHSA-2009:1040 affects the ntp package version up to and including 4.2.0.a.20040617-8.el4_7.2.
What type of vulnerability is described in RHSA-2009:1040?
RHSA-2009:1040 describes a buffer overflow vulnerability in the NTPv4 authentication code.
Can RHSA-2009:1040 be exploited remotely?
Yes, RHSA-2009:1040 can be exploited remotely if the ntpd daemon is configured to use specific authentication methods.
- agent/severity
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/title
- agent/description
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2009:1040
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/redhat