RHSA-2015:2231Medium

Red Hat Security Advisory: ntp security, bug fix, and enhancement update

Published
November 19, 2015
Last Modified
November 7, 2026

🔗 CVE IDs covered (7)

CVE-2014-9297 · no recordCVE-2014-9298 · no recordCVE-2014-9750 →CVE-2014-9751 →CVE-2015-1798 →CVE-2015-1799 →CVE-2015-3405 →

📋 Description

CVE-2014-9297 — ntp: vallen in extension fields are not validated CVE-2014-9298 — ntp: drop packets with source address ::1 CVE-2014-9750 — ntp: vallen in extension fields are not validated CVE-2014-9751 — ntp: drop packets with source address ::1 CVE-2015-1798 — ntp: ntpd accepts unauthenticated packets with symmetric key crypto CVE-2015-1799 — ntp: authentication doesn't protect symmetric associations against DoS attacks CVE-2015-3405 — ntp: ntp-keygen may generate non-random symmetric keys on big-endian systems

🎯 Affected products60

  • Red Hat Enterprise Linux Client (v. 7)
  • Red Hat Enterprise Linux Client Optional (v. 7)
  • Red Hat Enterprise Linux ComputeNode (v. 7)
  • Red Hat Enterprise Linux ComputeNode Optional (v. 7)
  • Red Hat Enterprise Linux Server (v. 7)
  • Red Hat Enterprise Linux Server Optional (v. 7)
  • Red Hat Enterprise Linux Workstation (v. 7)
  • Red Hat Enterprise Linux Workstation Optional (v. 7)
  • ntp-0:4.2.6p5-22.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-0:4.2.6p5-22.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-0:4.2.6p5-22.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-0:4.2.6p5-22.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-0:4.2.6p5-22.el7.src as a component of Red Hat Enterprise Linux Client (v. 7)
  • ntp-0:4.2.6p5-22.el7.src as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • ntp-0:4.2.6p5-22.el7.src as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-0:4.2.6p5-22.el7.src as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • ntp-0:4.2.6p5-22.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • ntp-0:4.2.6p5-22.el7.x86_64 as a component of Red Hat Enterprise Linux ComputeNode (v. 7)
  • ntp-0:4.2.6p5-22.el7.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-0:4.2.6p5-22.el7.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.s390x as a component of Red Hat Enterprise Linux Server (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)
  • ntp-debuginfo-0:4.2.6p5-22.el7.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)
  • +30 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: To work around this issue, instead of configuring NTP hosts as peers with the 'peer' directive, use the 'server' directive on both hosts so that the connection uses a regular client/server mode of operation. More information about how to configure NTP can be found at: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Deployment_Guide/ch-Configuring_NTP_Using_ntpd.html Autokey authentication between NTP peers is not sufficient to fully mitigate this issue.

🔗 References (15)