RHSA-2009:1040: Critical: ntp security update
The Network Time Protocol (NTP) is used to synchronize a computer's timewith a referenced time source.A buffer overflow flaw was discovered in the ntpd daemon's NTPv4authentication code. If ntpd was configured to use public key cryptographyfor NTP packet authentication, a remote attacker could use this flaw tosend a specially-crafted request packet that could crash ntpd or,potentially, execute arbitrary code with the privileges of the "ntp" user.(CVE-2009-1252)Note: NTP authentication is not enabled by default.A buffer overflow flaw was found in the ntpq diagnostic command. Amalicious, remote server could send a specially-crafted reply to an ntpqrequest that could crash ntpq or, potentially, execute arbitrary code withthe privileges of the user running the ntpq command. (CVE-2009-0159)All ntp users are advised to upgrade to this updated package, whichcontains backported patches to resolve these issues. After installing theupdate, the ntpd daemon will be restarted automatically.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:1040?
The severity of RHSA-2009:1040 is classified as critical due to the potential for remote code execution.
How do I fix RHSA-2009:1040?
To fix RHSA-2009:1040, upgrade the ntp package to the latest version provided by Red Hat.
What software is affected by RHSA-2009:1040?
RHSA-2009:1040 affects the ntp package version up to and including 4.2.0.a.20040617-8.el4_7.2.
What type of vulnerability is described in RHSA-2009:1040?
RHSA-2009:1040 describes a buffer overflow vulnerability in the NTPv4 authentication code.
Can RHSA-2009:1040 be exploited remotely?
Yes, RHSA-2009:1040 can be exploited remotely if the ntpd daemon is configured to use specific authentication methods.