SUSE-SU-2017:1048-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2017/suse-su-20171048-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:1048-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2017:1048-1
Related
Published
2017-04-18T14:06:01Z
Modified
2017-04-18T14:06:01Z
Summary
Security update for ntp
Details

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

  • CVE-2017-6464: Denial of Service via Malformed Config
  • CVE-2017-6462: Buffer Overflow in DPTS Clock
  • CVE-2017-6463: Authenticated DoS via Malicious Config Option
  • CVE-2017-6458: Potential Overflows in ctl_put() functions
  • CVE-2017-6451: Improper use of snprintf() in mx4200_send()
  • CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
  • CVE-2016-9042: 0rigin (zero origin) DoS.
  • ntpq_stripquotes() returns incorrect Value
  • ereallocarray()/eallocarray() underused
  • Copious amounts of Unused Code
  • Off-by-one in Oncore GPS Receiver
  • Makefile does not enforce Security Flags

Bugfixes:

  • Remove spurious log messages (bsc#1014172).
  • clang scan-build findings
  • Support for openssl-1.1.0 without compatibility modes
  • Bugfix 3072 breaks multicastclient
  • forking async worker: interrupted pipe I/O
  • (...) timeppscreate: Exec format error
  • Incorrect Logic for Peer Event Limiting
  • Change the process name of forked DNS worker
  • Trap Configuration Fail
  • Nothing happens if minsane < maxclock < minclock
  • allow -4/-6 on restrict line with mask
  • out-of-bound pointers in ctlputsys and decodebitflags
  • Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.
References

Affected packages

SUSE:Linux Enterprise Desktop 12 SP1 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}

SUSE:Linux Enterprise Desktop 12 SP2 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}

SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20Raspberry%20Pi%2012%20SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / ntp

Package

Name
ntp
Purl
pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.8p10-60.1

Ecosystem specific 

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p10-60.1",
            "ntp": "4.2.8p10-60.1"
        }
    ]
}