SUSE-SU-2017:1052-1
- Source
- https://www.suse.com/support/update/announcement/2017/suse-su-20171052-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2017:1052-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2017:1052-1
- Upstream
- Related
- Published
- 2017-04-18T14:06:55Z
- Modified
- 2026-02-04T03:30:54Z
- Summary
- Security update for ntp
- Details
-
This ntp update to version 4.2.8p10 fixes the following issues:
Security issues fixed (bsc#1030050):
- CVE-2017-6464: Denial of Service via Malformed Config
- CVE-2017-6462: Buffer Overflow in DPTS Clock
- CVE-2017-6463: Authenticated DoS via Malicious Config Option
- CVE-2017-6458: Potential Overflows in ctl_put() functions
- CVE-2017-6451: Improper use of snprintf() in mx4200_send()
- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
- CVE-2016-9042: 0rigin (zero origin) DoS.
- ntpq_stripquotes() returns incorrect Value
- ereallocarray()/eallocarray() underused
- Copious amounts of Unused Code
- Off-by-one in Oncore GPS Receiver
- Makefile does not enforce Security Flags
Bugfixes:
- Remove spurious log messages (bsc#1014172).
- Fixing ppc and ppc64 linker issue (bsc#1031085).
- clang scan-build findings
- Support for openssl-1.1.0 without compatibility modes
- Bugfix 3072 breaks multicastclient
- forking async worker: interrupted pipe I/O
- (...) time_pps_create: Exec format error
- Incorrect Logic for Peer Event Limiting
- Change the process name of forked DNS worker
- Trap Configuration Fail
- Nothing happens if minsane < maxclock < minclock
- allow -4/-6 on restrict line with mask
- out-of-bound pointers in ctl_putsys and decode_bitflags
- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.
- References
-
- https://www.suse.com/support/update/announcement/2017/suse-su-20171052-1/
- https://bugzilla.suse.com/1014172
- https://bugzilla.suse.com/1030050
- https://bugzilla.suse.com/1031085
- https://www.suse.com/security/cve/CVE-2016-9042
- https://www.suse.com/security/cve/CVE-2017-6451
- https://www.suse.com/security/cve/CVE-2017-6458
- https://www.suse.com/security/cve/CVE-2017-6460
- https://www.suse.com/security/cve/CVE-2017-6462
- https://www.suse.com/security/cve/CVE-2017-6463
- https://www.suse.com/security/cve/CVE-2017-6464
Affected packages
SUSE:Linux Enterprise Server 11 SP4 / ntp
Package
- Name
- ntp
- Purl
- pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4