Synopsis:          Important: ntp security update

Advisory ID:       SLSA-2016:0063-1

Issue Date:        2016-01-25

CVE Numbers:       CVE-2015-8138

--



It was discovered that ntpd as a client did not correctly check the

originate timestamp in received packets. A remote attacker could use this

flaw to send a crafted packet to an ntpd client that would effectively

disable synchronization with the server, or push arbitrary offset/delay

measurements to modify the time on the client. (CVE-2015-8138)



After installing the update, the ntpd daemon will restart automatically.

--



SL6

  x86_64

    ntp-4.2.6p5-5.el6_7.4.x86_64.rpm

    ntp-debuginfo-4.2.6p5-5.el6_7.4.x86_64.rpm

    ntpdate-4.2.6p5-5.el6_7.4.x86_64.rpm

    ntp-perl-4.2.6p5-5.el6_7.4.x86_64.rpm

  i386

    ntp-4.2.6p5-5.el6_7.4.i686.rpm

    ntp-debuginfo-4.2.6p5-5.el6_7.4.i686.rpm

    ntpdate-4.2.6p5-5.el6_7.4.i686.rpm

    ntp-perl-4.2.6p5-5.el6_7.4.i686.rpm

  noarch

    ntp-doc-4.2.6p5-5.el6_7.4.noarch.rpm

SL7

  x86_64

    ntp-4.2.6p5-22.el7_2.1.x86_64.rpm

    ntp-debuginfo-4.2.6p5-22.el7_2.1.x86_64.rpm

    ntpdate-4.2.6p5-22.el7_2.1.x86_64.rpm

    sntp-4.2.6p5-22.el7_2.1.x86_64.rpm

  noarch

    ntp-doc-4.2.6p5-22.el7_2.1.noarch.rpm

    ntp-perl-4.2.6p5-22.el7_2.1.noarch.rpm



- Scientific Linux Development Team