(RHSA-2009:1039) Important: ntp security update

2009-05-18T04:00:00
ID RHSA-2009:1039
Type redhat
Reporter RedHat
Modified 2017-09-08T12:06:52

Description

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

A buffer overflow flaw was discovered in the ntpd daemon's NTPv4 authentication code. If ntpd was configured to use public key cryptography for NTP packet authentication, a remote attacker could use this flaw to send a specially-crafted request packet that could crash ntpd. (CVE-2009-1252)

Note: NTP authentication is not enabled by default.

A buffer overflow flaw was found in the ntpq diagnostic command. A malicious, remote server could send a specially-crafted reply to an ntpq request that could crash ntpq. (CVE-2009-0159)

All ntp users are advised to upgrade to this updated package, which contains backported patches to resolve these issues. After installing the update, the ntpd daemon will be restarted automatically.