Synopsis

ntp security update

Type/Severity

Security Advisory: Low

Topic

Updated ntp packages that fix several bugs are now available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

The Network Time Protocol (NTP) is used to synchronize a computer's time
with a reference time source.

The NTP daemon (ntpd), when run with the -u option and using a string to
specify the group, uses the group ID of the user instead of the group,
which causes ntpd to run with different privileges than intended.
(CVE-2005-2496)

The following issues have also been addressed in this update:

• The init script had several problems
  
• The script executed on upgrade could fail
  
• The man page for ntpd indicated the wrong option for specifying a chroot
  directory
  
• The ntp daemon could crash with the message "Exiting: No more memory!"
  
• There is a new option for syncing the hardware clock after a successful
  run of ntpdate
  

Users of ntp should upgrade to these updated packages, which resolve these
issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 142926 - multiple problems with ntpd init.d script
• BZ - 149652 - CVE-2005-2496 improper group set when running ntpd
• BZ - 166773 - ntp %post scriptlet fails on upgrade, if ntpd is disabled.
• BZ - 177052 - ntpd dies with the error "Exiting: out of memory!"
• BZ - 187003 - ntpdate not invoked when supplying the -x option

CVEs

• CVE-2005-2496

References

• http://www.redhat.com/security/updates/classification/#low

Red Hat Enterprise Linux Server 4

SRPM
ntp-4.2.0.a.20040617-4.EL4.1.src.rpm	SHA-256: 9f826fb426dddabcfaa6991471e506a8103f7dcb9d3918d03589bd22c198c677
x86_64
ntp-4.2.0.a.20040617-4.EL4.1.x86_64.rpm	SHA-256: 9b685650264f97f1bf670e8faeccb281a660f1d4c5d48d593a9b2a8e40786192
ntp-4.2.0.a.20040617-4.EL4.1.x86_64.rpm	SHA-256: 9b685650264f97f1bf670e8faeccb281a660f1d4c5d48d593a9b2a8e40786192
ia64
ntp-4.2.0.a.20040617-4.EL4.1.ia64.rpm	SHA-256: 57b08eb1eafc9fc78b55e549499a9d1d38b5f3d1084b0ea625abdf7f3e4dd8b1
ntp-4.2.0.a.20040617-4.EL4.1.ia64.rpm	SHA-256: 57b08eb1eafc9fc78b55e549499a9d1d38b5f3d1084b0ea625abdf7f3e4dd8b1
i386
ntp-4.2.0.a.20040617-4.EL4.1.i386.rpm	SHA-256: 39cf2e7e44d990c59b4fe025f7983f84c385619906daa1655b16cc8c7dca2a73
ntp-4.2.0.a.20040617-4.EL4.1.i386.rpm	SHA-256: 39cf2e7e44d990c59b4fe025f7983f84c385619906daa1655b16cc8c7dca2a73

Red Hat Enterprise Linux Workstation 4

SRPM
ntp-4.2.0.a.20040617-4.EL4.1.src.rpm	SHA-256: 9f826fb426dddabcfaa6991471e506a8103f7dcb9d3918d03589bd22c198c677
x86_64
ntp-4.2.0.a.20040617-4.EL4.1.x86_64.rpm	SHA-256: 9b685650264f97f1bf670e8faeccb281a660f1d4c5d48d593a9b2a8e40786192
ia64
ntp-4.2.0.a.20040617-4.EL4.1.ia64.rpm	SHA-256: 57b08eb1eafc9fc78b55e549499a9d1d38b5f3d1084b0ea625abdf7f3e4dd8b1
i386
ntp-4.2.0.a.20040617-4.EL4.1.i386.rpm	SHA-256: 39cf2e7e44d990c59b4fe025f7983f84c385619906daa1655b16cc8c7dca2a73

Red Hat Enterprise Linux Desktop 4

SRPM
ntp-4.2.0.a.20040617-4.EL4.1.src.rpm	SHA-256: 9f826fb426dddabcfaa6991471e506a8103f7dcb9d3918d03589bd22c198c677
x86_64
ntp-4.2.0.a.20040617-4.EL4.1.x86_64.rpm	SHA-256: 9b685650264f97f1bf670e8faeccb281a660f1d4c5d48d593a9b2a8e40786192
i386
ntp-4.2.0.a.20040617-4.EL4.1.i386.rpm	SHA-256: 39cf2e7e44d990c59b4fe025f7983f84c385619906daa1655b16cc8c7dca2a73

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
ntp-4.2.0.a.20040617-4.EL4.1.src.rpm	SHA-256: 9f826fb426dddabcfaa6991471e506a8103f7dcb9d3918d03589bd22c198c677
s390x
ntp-4.2.0.a.20040617-4.EL4.1.s390x.rpm	SHA-256: 0525d296ef9f7bdb0586fb2853e28639a794f16bf6536415616fc2cd6bb43b80
s390
ntp-4.2.0.a.20040617-4.EL4.1.s390.rpm	SHA-256: 838b1a5fee7605381be3e8a9c30041b2986fa67ab9baf4624efd903b3ea2f563

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ntp-4.2.0.a.20040617-4.EL4.1.src.rpm	SHA-256: 9f826fb426dddabcfaa6991471e506a8103f7dcb9d3918d03589bd22c198c677
ppc
ntp-4.2.0.a.20040617-4.EL4.1.ppc.rpm	SHA-256: 763b36d08ec3e262aa1ce21bbea1b46ed30ccb5ae3912d395f1343c291ee8434