Updated ntp packages fix security vulnerabilities

This release addresses five security issues in ntpd for Mageia 6: LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of...

Network Time Protocol Forced Interleaved Time Spoofing Vulnerability(CVE-2016-1548)

SUMMARY It is possible to change the time of an ntpd client or deny service to an ntpd client by forcing it to change from basic client/server mode to interleaved symmetric mode. An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-dst...

RHEL 6 : ntp (RHSA-2016:1552)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:1552 advisory. - ntp: off-path denial of service on authenticated broadcast mode CVE-2015-7979 - ntp: crypto-NAK preemptable association denial of service...

Oracle Linux 6 / 7 : ntp (ELSA-2016-1141)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-1141 advisory. - don't allow spoofed packets to demobilize associations CVE-2015-7979, CVE-2016-1547 - don't allow spoofed packet to enable symmetric interleaved...

ntp: ntpd switching to interleaved mode with spoofed packets

It was found that an ntpd client could be forced to change from basic client/server mode to the interleaved symmetric mode. A remote attacker could use a spoofed packet that, when processed by an ntpd client, would cause that client to reject all future legitimate server responses, effectively...