Slackware-14.0 ChangeLog (2014-02-13)

Thu Feb 13 23:45:53 UTC 2014

  • patches/packages/ntp-4.2.6p5-i486-3_slack14.0.txz
    All stable versions of NTP remain vulnerable to a remote attack where the
    “ntpdc -c monlist” command can be used to amplify network traffic as part
    of a denial of service attack. By default, Slackware is not vulnerable
    since it includes “noquery” as a default restriction. However, it is
    vulnerable if this restriction is removed. To help mitigate this flaw,
    “disable monitor” has been added to the default ntp.conf (which will disable
    the monlist command even if other queries are allowed), and the default
    restrictions have been extended to IPv6 as well.
    All users of the NTP daemon should make sure that their ntp.conf contains
    “disable monitor” to prevent misuse of the NTP service. The new ntp.conf
    file will be installed as /etc/ with a package upgrade, but the
    changes will need to be merged into any existing ntp.conf file by the admin.
    For more information, see:
    (* Security fix *)
  • news/2014/02/13/slackware-14.0-changelog.txt
  • Last modified: 3 years ago
  • by Giuseppe Di Terlizzi