-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2015.2694
                      Important: ntp security update
                              27 October 2015

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           ntp
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 6
                   Red Hat Enterprise Linux WS/Desktop 6
                   Red Hat Enterprise Linux Server 7
                   Red Hat Enterprise Linux WS/Desktop 7
                   UNIX variants (UNIX, Linux, OSX)
Impact/Access:     Denial of Service              -- Remote/Unauthenticated
                   Provide Misleading Information -- Remote/Unauthenticated
Resolution:        Patch/Upgrade
CVE Names:         CVE-2015-7704 CVE-2015-5300 

Reference:         ESB-2015.2690
                   ESB-2015.2667

Original Bulletin: 
   https://rhn.redhat.com/errata/RHSA-2015-1930.html

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Red Hat. It is recommended that administrators
         running ntp check for an updated version of the software for their 
         operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: ntp security update
Advisory ID:       RHSA-2015:1930-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2015-1930.html
Issue date:        2015-10-26
CVE Names:         CVE-2015-5300 CVE-2015-7704 
=====================================================================

1. Summary:

Updated ntp packages that fix two security issues are now available for
Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode (v. 7) - x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux HPC Node (v. 6) - x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64

3. Description:

The Network Time Protocol (NTP) is used to synchronize a computer's time
with a referenced time source.

It was discovered that ntpd as a client did not correctly check timestamps
in Kiss-of-Death packets. A remote attacker could use this flaw to send a
crafted Kiss-of-Death packet to an ntpd client that would increase the
client's polling interval value, and effectively disable synchronization
with the server. (CVE-2015-7704)

It was found that ntpd did not correctly implement the threshold limitation
for the '-g' option, which is used to set the time without any
restrictions. A man-in-the-middle attacker able to intercept NTP traffic
between a connecting client and an NTP server could use this flaw to force
that client to make multiple steps larger than the panic threshold,
effectively changing the time to an arbitrary value. (CVE-2015-5300)

Red Hat would like to thank Aanchal Malhotra, Isaac E. Cohen, and Sharon
Goldberg of Boston University for reporting these issues.

All ntp users are advised to upgrade to these updated packages, which
contain backported patches to resolve these issues. After installing the
update, the ntpd daemon will restart automatically.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1271070 - CVE-2015-7704 ntp: disabling synchronization via crafted KoD packet
1271076 - CVE-2015-5300 ntp: MITM attacker can force ntpd to make a step larger than the panic threshold

6. Package List:

Red Hat Enterprise Linux Desktop (v. 6):

Source:
ntp-4.2.6p5-5.el6_7.2.src.rpm

i386:
ntp-4.2.6p5-5.el6_7.2.i686.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
ntpdate-4.2.6p5-5.el6_7.2.i686.rpm

x86_64:
ntp-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntpdate-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux Desktop Optional (v. 6):

i386:
ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
ntp-perl-4.2.6p5-5.el6_7.2.i686.rpm

noarch:
ntp-doc-4.2.6p5-5.el6_7.2.noarch.rpm

x86_64:
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-perl-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux HPC Node (v. 6):

Source:
ntp-4.2.6p5-5.el6_7.2.src.rpm

x86_64:
ntp-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntpdate-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux HPC Node Optional (v. 6):

noarch:
ntp-doc-4.2.6p5-5.el6_7.2.noarch.rpm

x86_64:
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-perl-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux Server (v. 6):

Source:
ntp-4.2.6p5-5.el6_7.2.src.rpm

i386:
ntp-4.2.6p5-5.el6_7.2.i686.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
ntpdate-4.2.6p5-5.el6_7.2.i686.rpm

ppc64:
ntp-4.2.6p5-5.el6_7.2.ppc64.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.ppc64.rpm
ntpdate-4.2.6p5-5.el6_7.2.ppc64.rpm

s390x:
ntp-4.2.6p5-5.el6_7.2.s390x.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.s390x.rpm
ntpdate-4.2.6p5-5.el6_7.2.s390x.rpm

x86_64:
ntp-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntpdate-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 6):

i386:
ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
ntp-perl-4.2.6p5-5.el6_7.2.i686.rpm

noarch:
ntp-doc-4.2.6p5-5.el6_7.2.noarch.rpm

ppc64:
ntp-debuginfo-4.2.6p5-5.el6_7.2.ppc64.rpm
ntp-perl-4.2.6p5-5.el6_7.2.ppc64.rpm

s390x:
ntp-debuginfo-4.2.6p5-5.el6_7.2.s390x.rpm
ntp-perl-4.2.6p5-5.el6_7.2.s390x.rpm

x86_64:
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-perl-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux Workstation (v. 6):

Source:
ntp-4.2.6p5-5.el6_7.2.src.rpm

i386:
ntp-4.2.6p5-5.el6_7.2.i686.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
ntpdate-4.2.6p5-5.el6_7.2.i686.rpm

x86_64:
ntp-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntpdate-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 6):

i386:
ntp-debuginfo-4.2.6p5-5.el6_7.2.i686.rpm
ntp-perl-4.2.6p5-5.el6_7.2.i686.rpm

noarch:
ntp-doc-4.2.6p5-5.el6_7.2.noarch.rpm

x86_64:
ntp-debuginfo-4.2.6p5-5.el6_7.2.x86_64.rpm
ntp-perl-4.2.6p5-5.el6_7.2.x86_64.rpm

Red Hat Enterprise Linux Client (v. 7):

Source:
ntp-4.2.6p5-19.el7_1.3.src.rpm

x86_64:
ntp-4.2.6p5-19.el7_1.3.x86_64.rpm
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
ntpdate-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

noarch:
ntp-doc-4.2.6p5-19.el7_1.3.noarch.rpm
ntp-perl-4.2.6p5-19.el7_1.3.noarch.rpm

x86_64:
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
sntp-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux ComputeNode (v. 7):

Source:
ntp-4.2.6p5-19.el7_1.3.src.rpm

x86_64:
ntp-4.2.6p5-19.el7_1.3.x86_64.rpm
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
ntpdate-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

noarch:
ntp-doc-4.2.6p5-19.el7_1.3.noarch.rpm
ntp-perl-4.2.6p5-19.el7_1.3.noarch.rpm

x86_64:
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
sntp-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
ntp-4.2.6p5-19.el7_1.3.src.rpm

ppc64:
ntp-4.2.6p5-19.el7_1.3.ppc64.rpm
ntp-debuginfo-4.2.6p5-19.el7_1.3.ppc64.rpm
ntpdate-4.2.6p5-19.el7_1.3.ppc64.rpm

s390x:
ntp-4.2.6p5-19.el7_1.3.s390x.rpm
ntp-debuginfo-4.2.6p5-19.el7_1.3.s390x.rpm
ntpdate-4.2.6p5-19.el7_1.3.s390x.rpm

x86_64:
ntp-4.2.6p5-19.el7_1.3.x86_64.rpm
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
ntpdate-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
ntp-4.2.6p5-19.ael7b_1.3.src.rpm

ppc64le:
ntp-4.2.6p5-19.ael7b_1.3.ppc64le.rpm
ntp-debuginfo-4.2.6p5-19.ael7b_1.3.ppc64le.rpm
ntpdate-4.2.6p5-19.ael7b_1.3.ppc64le.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

noarch:
ntp-doc-4.2.6p5-19.el7_1.3.noarch.rpm
ntp-perl-4.2.6p5-19.el7_1.3.noarch.rpm

ppc64:
ntp-debuginfo-4.2.6p5-19.el7_1.3.ppc64.rpm
sntp-4.2.6p5-19.el7_1.3.ppc64.rpm

s390x:
ntp-debuginfo-4.2.6p5-19.el7_1.3.s390x.rpm
sntp-4.2.6p5-19.el7_1.3.s390x.rpm

x86_64:
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
sntp-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

noarch:
ntp-doc-4.2.6p5-19.ael7b_1.3.noarch.rpm
ntp-perl-4.2.6p5-19.ael7b_1.3.noarch.rpm

ppc64le:
ntp-debuginfo-4.2.6p5-19.ael7b_1.3.ppc64le.rpm
sntp-4.2.6p5-19.ael7b_1.3.ppc64le.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
ntp-4.2.6p5-19.el7_1.3.src.rpm

x86_64:
ntp-4.2.6p5-19.el7_1.3.x86_64.rpm
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
ntpdate-4.2.6p5-19.el7_1.3.x86_64.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

noarch:
ntp-doc-4.2.6p5-19.el7_1.3.noarch.rpm
ntp-perl-4.2.6p5-19.el7_1.3.noarch.rpm

x86_64:
ntp-debuginfo-4.2.6p5-19.el7_1.3.x86_64.rpm
sntp-4.2.6p5-19.el7_1.3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2015-5300
https://access.redhat.com/security/cve/CVE-2015-7704
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2015 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFWLpsKXlSAg2UNWIIRAvn5AJ0YbKe9DZYq3JmTarVuEvM3l3fC3gCgmwd8
D1msx7GTmRIz9oZ3uE0m6Io=
=mPYp
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBVi7QGH6ZAP0PgtI9AQL2Mw//ezvzZfk/2cDjLl5aw6O04SMtRJmc7q6f
ZAyZuRi0NqD6cxArkmY7Z4wMTkGO4/rgTP/ywj2lXQDcrZG1O1s5dmaPwOqyMX5I
6L0cmuE0X3GBLvfXjJIjhsC3mLvMuje4khCBiCzHit5dtACypv96iluTAJ+q/8y6
cdxBLTREpv2DE/tX5LuFSMjAEhJzp9Xkw4LHqgq/9/cawZiM3dtS1mT/eCNM0vlo
bipeveGtcB16WcjTuAowXQTYciTvuVnbg6Wn2TxHDuPw5l0nrg8x4DO1Ho+zm2QM
d16whCizfSII4mY1hQysNsZPGvKAUE8YZYthiRUxJueNdOj7mFF1SgMCwypo9Vp2
7qV6QTLnuPkNR4UQ0WXac/RYEvYu+2B42yoUSvovB1NxpVsnMaastG5fCORg14QN
QD1PQx7SoxHO+f+iJrSSC85eu+bsE9F30toY3X/LNxCVnuhGH4KlsDm3tzbV0O4Z
enzB87vDQjZMpFdcdvE78a1tvVP0nvYJt2pK8QwqHkdqrZz9h70O/PGBFAQbB3y5
wahhrsZcTIHWr3z8bBaaC16Yn6+uRq36zbfJb2GixjRDTSUolse6LoI4Br3I+J0m
5k2s7+hBVLo3mQXVK7HkUj2jRgrPysVr1goZMrhn5BoULziU972H7HZe6SL48nQj
nE2NpwjPojY=
=qHpF
-----END PGP SIGNATURE-----