Mailinglist Archive: opensuse-updates (174 mails)

< Previous Next >
openSUSE-SU-2015:2016-1: moderate: Security update for ntp
openSUSE Security Update: Security update for ntp
______________________________________________________________________________

Announcement ID: openSUSE-SU-2015:2016-1
Rating: moderate
References: #951608
Cross-References: CVE-2015-7691 CVE-2015-7692 CVE-2015-7701
CVE-2015-7702 CVE-2015-7703 CVE-2015-7704
CVE-2015-7705 CVE-2015-7848 CVE-2015-7849
CVE-2015-7850 CVE-2015-7851 CVE-2015-7852
CVE-2015-7853 CVE-2015-7854 CVE-2015-7855
CVE-2015-7871
Affected Products:
openSUSE Leap 42.1
______________________________________________________________________________

An update that fixes 16 vulnerabilities is now available.

Description:

This ntp update provides the following security and non security fixes:

- Update to 4.2.8p4 to fix several security issues (bsc#951608):
* CVE-2015-7871: NAK to the Future: Symmetric association authentication
bypass via crypto-NAK
* CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning
FAIL on some bogus values
* CVE-2015-7854: Password Length Memory Corruption Vulnerability
* CVE-2015-7853: Invalid length data provided by a custom refclock
driver could cause a buffer overflow
* CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability
* CVE-2015-7851 saveconfig Directory Traversal Vulnerability
* CVE-2015-7850 remote config logfile-keyfile
* CVE-2015-7849 trusted key use-after-free
* CVE-2015-7848 mode 7 loop counter underrun
* CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC
* CVE-2015-7703 configuration directives "pidfile" and "driftfile"
should only be allowed locally
* CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should
validate the origin timestamp field
* CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey data
packet length checks
* obsoletes ntp-memlock.patch.
- Add a controlkey line to /etc/ntp.conf if one does not already exist to
allow runtime configuuration via ntpq.


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.1:

zypper in -t patch openSUSE-2015-767=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.1 (i586 x86_64):

ntp-4.2.8p4-9.2
ntp-debuginfo-4.2.8p4-9.2
ntp-debugsource-4.2.8p4-9.2
ntp-doc-4.2.8p4-9.2


References:

https://www.suse.com/security/cve/CVE-2015-7691.html
https://www.suse.com/security/cve/CVE-2015-7692.html
https://www.suse.com/security/cve/CVE-2015-7701.html
https://www.suse.com/security/cve/CVE-2015-7702.html
https://www.suse.com/security/cve/CVE-2015-7703.html
https://www.suse.com/security/cve/CVE-2015-7704.html
https://www.suse.com/security/cve/CVE-2015-7705.html
https://www.suse.com/security/cve/CVE-2015-7848.html
https://www.suse.com/security/cve/CVE-2015-7849.html
https://www.suse.com/security/cve/CVE-2015-7850.html
https://www.suse.com/security/cve/CVE-2015-7851.html
https://www.suse.com/security/cve/CVE-2015-7852.html
https://www.suse.com/security/cve/CVE-2015-7853.html
https://www.suse.com/security/cve/CVE-2015-7854.html
https://www.suse.com/security/cve/CVE-2015-7855.html
https://www.suse.com/security/cve/CVE-2015-7871.html
https://bugzilla.suse.com/951608


< Previous Next >
This Thread
  • No further messages