EnGarde Secure Linux Security Advisory: xntp i386 packages available

Apr 26, 2001, 18:00 (0 Talkback[s])

From:   security@guardiandigital.com
Subject:        [ESA-20010409-02] xntp i386 packages available
Date:   26 Apr 2001 12:48:08 -0400
 

+------------------------------------------------------------------------+
| EnGarde Secure Linux Security Advisory                  April 26, 2001 |
| http://www.engardelinux.org/                           ESA-20010409-02 |
|                                                                        |
| Package:  xntp3                                                        |
| Summary:  There is a potentially exploitable buffer overflow in the    |
|           xntp3 package.                                               |

(This advisory is being re-issued to denote the release of our updated packages for the i386 architecture.)

EnGarde Secure Linux is a secure distribution of Linux that features improved access control, host and network intrusion detection, Web based secure remote management, complete e-commerce using AllCommerce, and integrated open source security tools.

OVERVIEW

There is a very small buffer overflow in NTP daemon which shipped with EnGarde Secure Linux version 1.0.1.

DETAIL

The Network Time Protocol (NTP) is used to synchronize a computer's time with another reference time source. The xntp3 package contains utilities and daemons which will synchronize your computer's time to Coordinated Universal Time (UTC) via the NTP protocol and NTP servers.

By attacking a very small buffer with a very small set of shellcode, an attacker can potentially gain root access. It has been reported that in some cases the only effect is the segfault of the ntpd.

SOLUTION

All users running 'xntp3' should upgrade to the most recent version, as outlined in this advisory. All updates can be found at:

ftp://ftp.engardelinux.org/pub/engarde/stable/updates/ http://ftp.engardelinux.org/pub/engarde/stable/updates/

To install the updated package, execute the command:

rpm -Uvh <filename>

To verify the signature of the updated packages, execute the command:

rpm -Kv <filename>

UPDATED PACKAGES

Source Packages:

SRPMS/xntp3-5.93-1.0.16.src.rpm
MD5 Sum: 853821174dad6b5a979f6eaae8ce815a

i386 Binary Packages:

i386/xntp3-5.93-1.0.16.i386.rpm
MD5 Sum: de6b815ccca016108cbfb305c947eb14