CVE-2016-7429 Amazon Linux Security Advisory for ntp: ALAS-2017-781

The following security-related issues were resolved:

CVE-2016-7426 : Client rate limiting and server responses
CVE-2016-7429 : Attack on interface selection
CVE-2016-7433 : Broken initial sync calculations regression
CVE-2016-9310 : Mode 6 unauthenticated trap information disclosure and DDoS vector
CVE-2016-9311 : Null pointer dereference when trap service is enabled

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2017-781 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2017-781: Amazon Linux (ntp (4.2.6p5-43.33.amzn1) on noarch)

ALAS-2017-781: Amazon Linux (ntp (4.2.6p5-43.33.amzn1) on x86_64)

ALAS-2017-781: Amazon Linux (ntp (4.2.6p5-43.33.amzn1) on src)

ALAS-2017-781: Amazon Linux (ntp (4.2.6p5-43.33.amzn1) on i686)