RHSA-2009:1651: Moderate: ntp security update
The Network Time Protocol (NTP) is used to synchronize a computer's timewith a referenced time source.Robin Park and Dmitri Vinokurov discovered a flaw in the way ntpd handledcertain malformed NTP packets. ntpd logged information about all suchpackets and replied with an NTP packet that was treated as malformed whenreceived by another ntpd. A remote attacker could use this flaw to createan NTP packet reply loop between two ntpd servers via a malformed packetwith a spoofed source IP address and port, causing ntpd on those servers touse excessive amounts of CPU time and fill disk space with log messages.(CVE-2009-3563)A buffer overflow flaw was found in the ntpq diagnostic command. Amalicious, remote server could send a specially-crafted reply to an ntpqrequest that could crash ntpq or, potentially, execute arbitrary code withthe privileges of the user running the ntpq command. (CVE-2009-0159)All ntp users are advised to upgrade to this updated package, whichcontains backported patches to resolve these issues. After installing theupdate, the ntpd daemon will restart automatically.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2009:1651?
The severity of RHSA-2009:1651 is classified as moderate.
How do I fix RHSA-2009:1651?
To fix RHSA-2009:1651, update the Network Time Protocol (NTP) daemon to the latest version provided by your operating system vendor.
What specific vulnerability does RHSA-2009:1651 address?
RHSA-2009:1651 addresses a flaw in how ntpd handles malformed NTP packets.
Are there any workarounds for RHSA-2009:1651?
Temporary workarounds for RHSA-2009:1651 may include restricting NTP access to trusted sources only.
Who reported the vulnerability in RHSA-2009:1651?
The vulnerability in RHSA-2009:1651 was discovered by researchers Robin Park and Dmitri Vinokurov.