]> git.ipfire.org Git - ipfire-2.x.git/commit
ntp: Update to 4.2.8p11
authorMatthias Fischer <matthias.fischer@ipfire.org>
Wed, 7 Mar 2018 18:19:04 +0000 (19:19 +0100)
committerMichael Tremer <michael.tremer@ipfire.org>
Wed, 7 Mar 2018 18:44:04 +0000 (18:44 +0000)
commitd536c178ec90fd95b7e793923a856b8dab8bcb52
tree6016f179839df2a6636e280f9d050b15cb65eb67
parentcc4816a1af40ee470fad90e0a7ec1655dc36367b
ntp: Update to 4.2.8p11

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

"This release addresses five security issues in ntpd:

LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral
association attack
While fixed in ntp-4.2.8p7, there are significant additional protections for
this issue in 4.2.8p11.
Reported by Matt Van Gundy of Cisco.
INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun
leads to undefined behavior and information leak
Reported by Yihan Lian of Qihoo 360.
LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations
Reported on the questions@ list.
LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover
from bad state
Reported by Miroslav Lichvar of Red Hat.
LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset
authenticated interleaved association
Reported by Miroslav Lichvar of Red Hat.

one security issue in ntpq:

MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its
buffer limit
Reported by Michael Macnair of Thales-esecurity.com.

and provides over 33 bugfixes and 32 other improvements."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
lfs/ntp