Security update for ntp
Announcement ID: | SUSE-SU-2017:1052-1 |
Rating: | moderate |
References: | #1014172 #1030050 #1031085 |
Affected Products: |
An update that fixes 7 vulnerabilities is now available.
Description:
This ntp update to version 4.2.8p10 fixes the following issues:
Security issues fixed (bsc#1030050):
- CVE-2017-6464: Denial of Service via Malformed Config
- CVE-2017-6462: Buffer Overflow in DPTS Clock
- CVE-2017-6463: Authenticated DoS via Malicious Config Option
- CVE-2017-6458: Potential Overflows in ctl_put() functions
- CVE-2017-6451: Improper use of snprintf() in mx4200_send()
- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
- CVE-2016-9042: 0rigin (zero origin) DoS.
- ntpq_stripquotes() returns incorrect Value
- ereallocarray()/eallocarray() underused
- Copious amounts of Unused Code
- Off-by-one in Oncore GPS Receiver
- Makefile does not enforce Security Flags
Bugfixes:
- Remove spurious log messages (bsc#1014172).
- Fixing ppc and ppc64 linker issue (bsc#1031085).
- clang scan-build findings
- Support for openssl-1.1.0 without compatibility modes
- Bugfix 3072 breaks multicastclient
- forking async worker: interrupted pipe I/O
- (...) time_pps_create: Exec format error
- Incorrect Logic for Peer Event Limiting
- Change the process name of forked DNS worker
- Trap Configuration Fail
- Nothing happens if minsane
- allow -4/-6 on restrict line with mask
- out-of-bound pointers in ctl_putsys and decode_bitflags
- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard
directory and causes problems for transactional updates.
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11-SP4:
zypper in -t patch slessp4-ntp-13066=1
- SUSE Linux Enterprise Debuginfo 11-SP4:
zypper in -t patch dbgsp4-ntp-13066=1
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- ntp-4.2.8p10-63.1
- ntp-doc-4.2.8p10-63.1
- SUSE Linux Enterprise Debuginfo 11-SP4 (i586 ia64 ppc64 s390x x86_64):
- ntp-debuginfo-4.2.8p10-63.1
- ntp-debugsource-4.2.8p10-63.1
References:
- https://www.suse.com/security/cve/CVE-2016-9042.html
- https://www.suse.com/security/cve/CVE-2017-6451.html
- https://www.suse.com/security/cve/CVE-2017-6458.html
- https://www.suse.com/security/cve/CVE-2017-6460.html
- https://www.suse.com/security/cve/CVE-2017-6462.html
- https://www.suse.com/security/cve/CVE-2017-6463.html
- https://www.suse.com/security/cve/CVE-2017-6464.html
- https://bugzilla.suse.com/1014172
- https://bugzilla.suse.com/1030050
- https://bugzilla.suse.com/1031085