SUSE-SU-2015:0259-3

The NTP time service could have been used for remote denial of service amplification attacks.

This issue can be fixed by the administrator as we described in our security advisory SUSE-SA:2014:001

http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00005.html

and on

http://support.novell.com/security/cve/CVE-2013-5211.html http://support.novell.com/security/cve/CVE-2013-5211.html

this update now also replaces the default ntp.conf template to fix this problem.

Please note that if you have touched or modified ntp.conf yourself, it will not be automatically fixed, you need to merge the changes manually as described.

Additionally the following bug has been fixed:

* ntp start script does not update /var/lib/ntp/etc/localtime file if
  /etc/localtime is symlink (bnc#838458)

Security Issues:

* CVE-2013-5211
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5211>