0

I have NTP 4.2.6p5 installed on my CentOS 7.5. Due to "Network Time Protocol Multiple Security Vulnerabilities" vulnerability I have to upgrade it to latest NTP 4.2.8p13 version.

Now the problem is, I can not find latest available version using yum whatprovides.

[root@6ef77e1541c7 ~]# yum whatprovides ntp
 ntp-4.2.6p5-28.el7.centos.x86_64 : The NTP daemon and utilities
 Repo        : base

Anyone has any idea how do I upgrade NTP to latest version 4.2.8p13 to fix this vulnerability ?

EDIT-1

I've installed the NTP latest version from source but I'm not sure how do I start services when it is installed from source.

Also, I have removed old rpm packages.

EDIT-2

CVE-2015-7871, CVE-2015-7855, CVE-2015-7854, CVE-2015-7853, CVE-2015-7852, CVE- 
 2015-7851, CVE-2015-7850, CVE-2015-7849, CVE-2015-7848, CVE-2015-7701, CVE- 
 2015-7703, CVE-2015-7704, CVE-2015-7705, CVE-2015-7691, CVE-2015-7692, CVE- 
 2015-7702
Improve this question
3
  • 2
    Generally speaking (I don't have a CentOS system at-hand to verify), distributions will release package updates when they're ready. If you need a newer version sooner, you may have to compile and install it yourself. Keep in mind that you'll then be responsible for maintaining that software going forward (as opposed to the distribution's teams). – Jeff Schaller♦ May 30 '19 at 14:35
  • Could you add the specific CVE (or equivalent) that you're responding to; or do you specifically need to get to 4.2.8p13 (or is that just the latest version seen on ntp.org)? – Jeff Schaller♦ May 30 '19 at 16:06
  • @JeffSchaller - I have added CVE IDs. As per Qualys recommendation I need to install 4.2.8p13 to address all above mentioned CVE IDs and yes that is the latest version seen on ntp.org – Juned May 31 '19 at 7:53
1

You really should just use the package from CentOS. It has all the backported fixes, and CentOS will continue to fix security updates, unlike your build-from-source solution, which will need to be rebuilt each time NTP posts another CVE.

If you just run “yum update ntp” you will get all the following CVEs addressed. Whoever is telling you that those CVEs aren’t addressed should look at that page too. For many of them, Redhat says that the ntp package in el7 isn’t even affected.

Don’t blindly believe the security auditors, most often they’re just folks who got trained to run a tool on a windows computer (you are lucky if they even know about Linux) and parrot the results and have no depth of understanding of how an enterprise Linux OS works. Redhat (and subsequently CentOS) backports security fixes to a stable version of a package. Maintaining your own build of the latest version is actually more of a security risk because now you have to rebuild it each time there’s a security fix.

EDIT: Also, please direct your security auditors or anyone telling you to upgrade ntp to the latest version to read Redhat’s discussion of backports

.

Improve this answer
1
  • Thanks for the answer and those links. Indeed, security auditor does not have depth understanding of how Linux OS works. – Juned Jun 3 '19 at 9:47
0

For stability purposes and quick convergence and time maintence among many hosts, I have been using chrony instead of ntp. In fact, I believe that from RHEL/Centos 7.x chrony is the primary network time package provided by default.

However to your point, if you want to stay in sync of your distribution, you can just wait until a new version is released by the vendor. In the case of RHEL/Centos, the primary version listed on the package generally does not change at all during the life of the major point system revision. What happens is that patches get backported and the -# reflects the change. So although your package inventory indicates one version, it could very well be updated to the current version. This makes it hard for administrators to verify specific version numbers of a package globally and compare them.

If you really, really want to upgrade to the new version, you can download the source package and use that as a base to get to the new version. I have had to do this for some packages that were critical...its not all that hard, but you will have to weed through all the patches that already exist.

Improve this answer
3
  • I tried to install NTP from source now I do not find commands to reload services and configuration file (ntp.conf). when we install it from yum or rpm it generates startup services and configuration files automatically.any idea ? – Juned May 31 '19 at 10:00
  • No, the person who built the RPM package wrote the service files and initial configuration and included them into the package. If you install NTP from source, you'll have to create the service file and the configuration yourself. – telcoM May 31 '19 at 12:52
  • Agree, I am ok with creating service file but I couldn't find any instructions for that in README of NTP source – Juned May 31 '19 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.