From: Slackware Security Team <security@slackware.com>
To: slackware-security@slackware.com
Subject: [slackware-security] ntp (SSA:2015-188-03)
Date: Tue, 7 Jul 2015 17:00:58 -0700 (PDT)





-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] ntp (SSA:2015-188-03)

New ntp packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1,
and -current to fix a security issue.


Here are the details from the Slackware 14.1 ChangeLog:
+--------------------------+
patches/packages/ntp-4.2.8p3-i486-1_slack14.1.txz: Upgraded.
This update fixes a security issue where under specific circumstances an
attacker can send a crafted packet to cause a vulnerable ntpd instance to
crash. Since this requires 1) ntpd set up to allow remote configuration
(not allowed by default), and 2) knowledge of the configuration password,
and 3) access to a computer entrusted to perform remote configuration,
the vulnerability is considered low-risk.
For more information, see:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5146
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ntp-4.2.8p3-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/ntp-4.2.8p3-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ntp-4.2.8p3-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/ntp-4.2.8p3-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/ntp-4.2.8p3-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/ntp-4.2.8p3-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/ntp-4.2.8p3-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/ntp-4.2.8p3-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/ntp-4.2.8p3-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/ntp-4.2.8p3-x86_64-1_slack14.1.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/ntp-4.2.8p3-i486-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/n/ntp-4.2.8p3-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 13.0 package:
a1780621556bf581833f0a46c21812cd ntp-4.2.8p3-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
fbece86086ef7e84e02e959cfab92883 ntp-4.2.8p3-x86_64-1_slack13.0.txz

Slackware 13.1 package:
020367073707b66ec4992de74b315f0f ntp-4.2.8p3-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
87663d4a7c7699df446fc93705442681 ntp-4.2.8p3-x86_64-1_slack13.1.txz

Slackware 13.37 package:
c9a263e726932d81eab293725b4cb84f ntp-4.2.8p3-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
d2cdaf7078872c162161c5356af82057 ntp-4.2.8p3-x86_64-1_slack13.37.txz

Slackware 14.0 package:
db95841f80cd3e019109416636e6e8bd ntp-4.2.8p3-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
7f6094e35e892e4d77201602b04430b7 ntp-4.2.8p3-x86_64-1_slack14.0.txz

Slackware 14.1 package:
cb60dd8aa75c7ac9e7a3a38cc055df9b ntp-4.2.8p3-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
bba510875648be7eb2e6f206947824a7 ntp-4.2.8p3-x86_64-1_slack14.1.txz

Slackware -current package:
db3a89a88447f5886a4b4fe4f24680a7 n/ntp-4.2.8p3-i486-1.txz

Slackware x86_64 -current package:
feff97f062bf9e536e4ebf31c7bd2361 n/ntp-4.2.8p3-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg ntp-4.2.8p3-i486-1_slack14.1.txz

Then, restart the NTP daemon:
# sh /etc/rc.d/rc.ntpd restart


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlWcT3YACgkQakRjwEAQIjMKxwCfaJuFB/cSVf8MSajXGJXU99s0
23sAn2k9wZqu06xw+yzLABZCGpxSjueN
=1FKI
-----END PGP SIGNATURE-----