USN-3707-1: NTP vulnerabilities


#1

The USN-3707-1: NTP vulnerabilities are fixed automatically and installed on SecureDrop production instances. I received the following OSSEC alerts (one mail per alert).

OSSEC HIDS Notification.
2018 Jul 10 04:17:30

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/bin/ntpq'
Old md5sum was: 'ffa0b570777879ca6ca497c8934bef7d'
New md5sum is : '0b51d8e9753972c1083e8173bf11cbc0'
Old sha1sum was: '1b0ab393c292569d2fee4bfea501e62fad05ae13'
New sha1sum is : 'c8e67176c87a81b64015a84320f1bc84c7ef3f56'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:18:01

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/bin/sntp'
Old md5sum was: '04d2b46bc7f0f5c99d7b233b31b95514'
New md5sum is : '1783f50175a737f82992a6181063df21'
Old sha1sum was: 'f354553c3321d1e9a391f3c6423ec1e0d7000346'
New sha1sum is : '4d669f1e3d378f047e4e8b318a0e16b2251145b7'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:18:40

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/bin/ntpdc'
Old md5sum was: 'e0cfedcefa03275e88b1141a581df0a6'
New md5sum is : '89e84dbf4610db53071ee62e1c158373'
Old sha1sum was: '3679e84d198a20b9c605192ced138711e00b8aa9'
New sha1sum is : 'b80a3ef6d972ac4d668dcd2d1c5b24a395aca728'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:19:13

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/sbin/ntp-keygen'
Old md5sum was: 'b45bdd861a62cf0dd25de05dd501209f'
New md5sum is : '82cba70e9fb3cda11a6fb7e358aded7d'
Old sha1sum was: '7a026c1a6d00bb414805a42e4bf998582aa10ae4'
New sha1sum is : '344fd6363f9582bf926fc62630412e4766589a7a'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:19:20

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/sbin/ntpd'
Old md5sum was: '5cf3c5b0008945dcd586fea4ab59c492'
New md5sum is : '728c40ded2219cc22b4d9d0a1299b09a'
Old sha1sum was: '4379630564650c4da6a3b72dcd87bc2b814f7d01'
New sha1sum is : 'f3b0fc401c5564573b2a8b7910562c49cbdd3444'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:19:17

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/sbin/ntptime'
Old md5sum was: '5d907c76fae036f5488b981441142a55'
New md5sum is : '3d828e14b4890dbee93a689d6a625663'
Old sha1sum was: '566191ba98bdfd046b6591efb7b5854f0acdbc9e'
New sha1sum is : '049eb28853f4c76e63b48e1f9923a8a4a49d6a60'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:19:24

Received From: mon->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/sbin/ntpdate'
Old md5sum was: '2767fd99374b893da98ae5f4bd470244'
New md5sum is : 'c30130450c942d5b0a4c1c7885f275bc'
Old sha1sum was: '13eaa7a1a82f36f351c2dca9a78a5364536c6077'
New sha1sum is : '1330cb51d326435588a16d1267e83c03d93b8368'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:34:37

Received From: (app) A.B.C.D->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/sbin/ntpdate'
Old md5sum was: '2767fd99374b893da98ae5f4bd470244'
New md5sum is : 'c30130450c942d5b0a4c1c7885f275bc'
Old sha1sum was: '13eaa7a1a82f36f351c2dca9a78a5364536c6077'
New sha1sum is : '1330cb51d326435588a16d1267e83c03d93b8368'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:34:39

Received From: (app) A.B.C.D->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/bin/ntpdc'
Old md5sum was: 'e0cfedcefa03275e88b1141a581df0a6'
New md5sum is : '89e84dbf4610db53071ee62e1c158373'
Old sha1sum was: '3679e84d198a20b9c605192ced138711e00b8aa9'
New sha1sum is : 'b80a3ef6d972ac4d668dcd2d1c5b24a395aca728'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:34:39

Received From: (app) A.B.C.D->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/bin/ntpq'
Old md5sum was: 'ffa0b570777879ca6ca497c8934bef7d'
New md5sum is : '0b51d8e9753972c1083e8173bf11cbc0'
Old sha1sum was: '1b0ab393c292569d2fee4bfea501e62fad05ae13'
New sha1sum is : 'c8e67176c87a81b64015a84320f1bc84c7ef3f56'

 --END OF NOTIFICATION

OSSEC HIDS Notification.
2018 Jul 10 04:34:39

Received From: (app) A.B.C.D->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/usr/bin/sntp'
Old md5sum was: '04d2b46bc7f0f5c99d7b233b31b95514'
New md5sum is : '1783f50175a737f82992a6181063df21'
Old sha1sum was: 'f354553c3321d1e9a391f3c6423ec1e0d7000346'
New sha1sum is : '4d669f1e3d378f047e4e8b318a0e16b2251145b7'

 --END OF NOTIFICATION