CVE-2013-5211

The "monlist" command of the NTP protocol is currently abused in a DDoS reflection attack. This is done by spoofing packets from addresses to which the attack is directed to. The ntp installations itself are not target of the attack, but they are part of the DDoS network which the attacker is driving (CVE-2013-5211).

** IMPORTANT **

Note: the workaround for this issue is not a change in the software, but instead is a change in the default configuration. In most cases, the configuration change will need to be made manually by administrators in the /etc/ntp.conf file, as the package will only install the updated configuration as /etc/ntp.conf.rpmnew. The following lines should be added to the end of /etc/ntp.conf:

Permit time synchronization with our time source, but do not

permit the source to query or modify the service on this system.

restrict default nomodify notrap nopeer noquery

These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.

This update for ntp provides the following fixes:

* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
  (bnc#887957)
* Fix orphan mode. (bnc#883859)

The NTP time service could have been used for remote denial of service amplification attacks.

This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001

http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html

and on

http://support.novell.com/security/cve/CVE-2013-5211.html http://support.novell.com/security/cve/CVE-2013-5211.html

this update now also replaces the default ntp.conf template to fix this problem.

Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described.

Additionally the following bug has been fixed:

* ntp start script does not update /var/lib/ntp/etc/localtime file if
  /etc/localtime is symlink (bnc#838458)

Security Issues:

* CVE-2013-5211
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211>

This update for ntp provides the following fixes:

* Respect NTPD_FORCE_SYNC_ON_STARTUP also for dynamic peers.
  (bnc#887957)
* Fix orphan mode. (bnc#883859)