Detections
Analytics

openSUSE Security Update : ntp (openSUSE-2017-511)

high Nessus Plugin ID 99700

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050) :

 - CVE-2017-6464: Denial of Service via Malformed Config

 - CVE-2017-6462: Buffer Overflow in DPTS Clock

 - CVE-2017-6463: Authenticated DoS via Malicious Config Option

 - CVE-2017-6458: Potential Overflows in ctl_put() functions

 - CVE-2017-6451: Improper use of snprintf() in mx4200_send()

 - CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist

 - CVE-2016-9042: 0rigin (zero origin) DoS.

 - ntpq_stripquotes() returns incorrect Value

 - ereallocarray()/eallocarray() underused

 - Copious amounts of Unused Code

 - Off-by-one in Oncore GPS Receiver

 - Makefile does not enforce Security Flags

Bugfixes :

 - Remove spurious log messages (bsc#1014172).

 - clang scan-build findings

 - Support for openssl-1.1.0 without compatibility modes

 - Bugfix 3072 breaks multicastclient

 - forking async worker: interrupted pipe I/O

 - (...) time_pps_create: Exec format error

 - Incorrect Logic for Peer Event Limiting

 - Change the process name of forked DNS worker

 - Trap Configuration Fail

 - Nothing happens if minsane < maxclock < minclock

 - allow -4/-6 on restrict line with mask

 - out-of-bound pointers in ctl_putsys and decode_bitflags

 - Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

This update was imported from the SUSE:SLE-12-SP1:Update update project.

Solution

Update the affected ntp packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=1014172

https://bugzilla.opensuse.org/show_bug.cgi?id=1030050

https://features.opensuse.org/

Plugin Details

Severity: High

ID: 99700

File Name: openSUSE-2017-511.nasl

Version: 3.8

Type: local

Agent: unix

Published: 4/27/2017

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:ntp, p-cpe:/a:novell:opensuse:ntp-debuginfo, p-cpe:/a:novell:opensuse:ntp-debugsource, cpe:/o:novell:opensuse:42.1, cpe:/o:novell:opensuse:42.2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 4/26/2017

Reference Information

CVE: CVE-2016-9042, CVE-2017-6451, CVE-2017-6458, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464