SUSE-SU-2018:1765-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2018/suse-su-20181765-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2018:1765-1.json

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2018:1765-1

Related

Published

2018-06-20T13:46:39Z

Modified

2018-06-20T13:46:39Z

Summary

Security update for ntp

Details

This update for ntp fixes the following issues:

Update to 4.2.8p11 (bsc#1082210):
- CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11.
- CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426)
- CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424)
- CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422)
- CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420)
- CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417)
Don't use libevent's cached time stamps in sntp. (bsc#1077445)

This update is a reissue of the previous update with LTSS channels included.

References

Affected packages

SUSE:OpenStack Cloud 7 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20OpenStack%20Cloud%207

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Desktop 12 SP3 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP1 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP2 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP1-LTSS / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP2-LTSS / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server 12 SP3 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Linux Enterprise Server for SAP Applications 12 SP3 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}

SUSE:Enterprise Storage 4 / ntp

Package

Name: ntp
Purl: pkg:rpm/suse/ntp&distro=SUSE%20Enterprise%20Storage%204

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.8p11-64.5.1

Ecosystem specific

{
    "binaries": [
        {
            "ntp-doc": "4.2.8p11-64.5.1",
            "ntp": "4.2.8p11-64.5.1"
        }
    ]
}