==========================================================================
Ubuntu Security Notice USN-3707-1
July 09, 2018

ntp vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 18.04 LTS
– Ubuntu 17.10
– Ubuntu 16.04 LTS
– Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in NTP.

Software Description:
– ntp: Network Time Protocol daemon and utility programs

Details:

Yihan Lian discovered that NTP incorrectly handled certain malformed mode 6
packets. A remote attacker could possibly use this issue to cause ntpd to
crash, resulting in a denial of service. This issue only affected Ubuntu
17.10 and Ubuntu 18.04 LTS. (CVE-2018-7182)

Michael Macnair discovered that NTP incorrectly handled certain responses.
A remote attacker could possibly use this issue to execute arbitrary code.
(CVE-2018-7183)

Miroslav Lichvar discovered that NTP incorrectly handled certain
zero-origin timestamps. A remote attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 17.10 and Ubuntu
18.04 LTS. (CVE-2018-7184)

Miroslav Lichvar discovered that NTP incorrectly handled certain
zero-origin timestamps. A remote attacker could possibly use this issue to
cause a denial of service. (CVE-2018-7185)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
ntp 1:4.2.8p10+dfsg-5ubuntu7.1

Ubuntu 17.10:
ntp 1:4.2.8p10+dfsg-5ubuntu3.3

Ubuntu 16.04 LTS:
ntp 1:4.2.8p4+dfsg-3ubuntu5.9

Ubuntu 14.04 LTS:
ntp 1:4.2.6.p5+dfsg-3ubuntu2.14.04.13

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/usn/usn-3707-1
CVE-2018-7182, CVE-2018-7183, CVE-2018-7184, CVE-2018-7185

Package Information:
https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p10+dfsg-5ubuntu7.1
https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p10+dfsg-5ubuntu3.3
https://launchpad.net/ubuntu/+source/ntp/1:4.2.8p4+dfsg-3ubuntu5.9
https://launchpad.net/ubuntu/+source/ntp/1:4.2.6.p5+dfsg-3ubuntu2.14.04.13

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAltDpzEACgkQZWnYVadE
vpPJmg/+MRZbPYap8S6hjqSoTl37nQKKoPDwJWj3N3Chs8KsBPhUGm4bg2msVI2z
hHtMaln/Mh5Pgsj8ccFbPU7mTtA+dtEREukjRqsFxTLlFixEe67ISMWTRrthkDbu
rG5OdJQQvSsnp7LZaoemCZx3X8ohSVKBuuEOsI6pgyWWo84z0RqIF6RyxuS3QzUx
d5hjpj1vmG9xOvm5fYstPyYWuJ/vGitOtqVkq2BtOQ12EeCwss5sMnyjpZXM9v59
M3I2cFFHL8aziqVDEJISOvxdQjfH3dMBZ7GqD5oycqkjbMLCtuijQT9kkwLy/8k4
qIfrPv+J3GIRtMt18Z574hVujxkUttKffspRBOM/jJbHq4DWwf0zPIyyShHx0VP2
zPXO2yOJ4QqWY56GTQAL8cyv2uQQhI7bUur9ezt/bCvL+JbDWFfAUNURBEqaHk2M
uk8ltmmR/LjPaWuZtS9bDFrKG6kqmQEfACnmxixmOCwlm+BxSXy4UcUPNsH8qiC7
HqaRtmcDhv1iC5oxMUhKpFroZgWqkXKo7rje5jFGMK8vR4QHjeY4O2GdELQXGTSh
JRUGO/5SouAGax0STKbDuXET3FYCyDtsguzQnTF+w0D/qJn1emY1GMuHSN0TtXcI
6/fvmH6up4oO6q/5o1VJRn0GKJG0zczAExRf8M4/pz+TFzWujZQ=
=U0wS
—–END PGP SIGNATURE—–
—