Advisories ยป MGASA-2014-0032

Updated ntp packages work around security vulnerability

Publication date: 31 Jan 2014
Modification date: 31 Jan 2014
Type: security
Affected Mageia releases : 3
CVE: CVE-2013-5211

Description

The "monlist" command of the NTP protocol is currently abused in a DDoS
reflection attack. This is done by spoofing packets from addresses to
which the attack is directed to. The ntp installations itself are not
target of the attack, but they are part of the DDoS network which the
attacker is driving (CVE-2013-5211).

** IMPORTANT **

Note: the workaround for this issue is not a change in the software, but
instead is a change in the default configuration.  In most cases, the
configuration change will need to be made manually by administrators in
the /etc/ntp.conf file, as the package will only install the updated
configuration as /etc/ntp.conf.rpmnew. The following lines should be added
to the end of /etc/ntp.conf:

# Permit time synchronization with our time source, but do not
# permit the source to query or modify the service on this system.
restrict default nomodify notrap nopeer noquery

References

SRPMS

3/core