Red Hat Security AdvisoryRHSA-2018:0855
ntp security, bug fix, and enhancement update
Released 2018-04-10 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) ntp-4.2.6p5-28.el7, ntpdate-4.2.6p5-28.el7
- Red Hat Enterprise Linux Client Optional (v. 7) ntp-doc-4.2.6p5-28.el7, ntp-perl-4.2.6p5-28.el7, sntp-4.2.6p5-28.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) ntp-4.2.6p5-28.el7, ntpdate-4.2.6p5-28.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) ntp-doc-4.2.6p5-28.el7, ntp-perl-4.2.6p5-28.el7, sntp-4.2.6p5-28.el7
- Red Hat Enterprise Linux Server (v. 7) ntp-4.2.6p5-28.el7, ntpdate-4.2.6p5-28.el7
- Red Hat Enterprise Linux Server Optional (v. 7) ntp-doc-4.2.6p5-28.el7, ntp-perl-4.2.6p5-28.el7, sntp-4.2.6p5-28.el7
- Red Hat Enterprise Linux Workstation (v. 7) ntp-4.2.6p5-28.el7, ntpdate-4.2.6p5-28.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) ntp-doc-4.2.6p5-28.el7, ntp-perl-4.2.6p5-28.el7, sntp-4.2.6p5-28.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) ntp-4.2.6p5-28.el7, ntpdate-4.2.6p5-28.el7
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) ntp-doc-4.2.6p5-28.el7, ntp-perl-4.2.6p5-28.el7, sntp-4.2.6p5-28.el7
Fixes 3 records
Priority LOW 37
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.05103 · Published 2017-03-27 · Partial fix CWE-20
Priority LOW 37
NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.05239 · Published 2017-03-27 · Partial fix CWE-20
Priority LOW 35
Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00491 · Published 2017-03-27 · Partial fix CWE-119
THREATIST.IORead the docs