From d536c178ec90fd95b7e793923a856b8dab8bcb52 Mon Sep 17 00:00:00 2001 From: Matthias Fischer Date: Wed, 7 Mar 2018 19:19:04 +0100 Subject: [PATCH] ntp: Update to 4.2.8p11 For details see: http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities "This release addresses five security issues in ntpd: LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephemeral association attack While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. Reported by Matt Van Gundy of Cisco. INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak Reported by Yihan Lian of Qihoo 360. LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral associations Reported on the questions@ list. LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot recover from bad state Reported by Miroslav Lichvar of Red Hat. LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can reset authenticated interleaved association Reported by Miroslav Lichvar of Red Hat. one security issue in ntpq: MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write beyond its buffer limit Reported by Michael Macnair of Thales-esecurity.com. and provides over 33 bugfixes and 32 other improvements." Best, Matthias Signed-off-by: Matthias Fischer Signed-off-by: Michael Tremer --- lfs/ntp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/ntp b/lfs/ntp index 1f1c5244dd..9c5e772ac2 100644 --- a/lfs/ntp +++ b/lfs/ntp @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2017 IPFire Team # +# Copyright (C) 2007-2018 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 4.2.8p10 +VER = 4.2.8p11 THISAPP = ntp-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = 745384ed0dedb3f66b33fe84d66466f9 +$(DL_FILE)_MD5 = 00950ca2855579541896513e78295361 install : $(TARGET) -- 2.39.2