Security update for ntp
SUSE Patch
security@suse.de
SUSE Security Team
openSUSE-SU-2016:1583-1
Final
1
1
2016-06-15T06:03:16Z
current
2016-06-15T06:03:16Z
2016-06-15T06:03:16Z
cve-database/bin/generate-cvrf.pl
2017-02-24T01:00:00Z
Security update for ntp
ntp was updated to fix five security issues.
These security issues were fixed:
- CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065).
- CVE-2016-4954: Processing spoofed server packets (bsc#982066).
- CVE-2016-4955: Autokey association reset (bsc#982067).
- CVE-2016-4956: Broadcast interleave (bsc#982068).
- CVE-2016-4957: CRYPTO_NAK crash (bsc#982064).
These non-security issues were fixed:
- bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice.
- bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service.
- bsc#981422: Don't ignore SIGCHILD because it breaks wait().
- Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver".
The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
E-Mail link for openSUSE-SU-2016:1583-1
https://www.suse.com/support/security/rating/
SUSE Security Ratings
openSUSE 13.2
ntp-4.2.8p8-25.18.1
ntp-debuginfo-4.2.8p8-25.18.1
ntp-debugsource-4.2.8p8-25.18.1
ntp-doc-4.2.8p8-25.18.1
ntp-4.2.8p8-25.18.1 as a component of openSUSE 13.2
ntp-debuginfo-4.2.8p8-25.18.1 as a component of openSUSE 13.2
ntp-debugsource-4.2.8p8-25.18.1 as a component of openSUSE 13.2
ntp-doc-4.2.8p8-25.18.1 as a component of openSUSE 13.2
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.
CVE-2016-4953
openSUSE 13.2:ntp-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1
openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1
important
2.5
AV:N/AC:H/Au:N/C:N/I:N/A:P
Please Install the update.
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
https://www.suse.com/security/cve/CVE-2016-4953.html
CVE-2016-4953
https://bugzilla.suse.com/962784
SUSE Bug 962784
https://bugzilla.suse.com/977459
SUSE Bug 977459
https://bugzilla.suse.com/982056
SUSE Bug 982056
https://bugzilla.suse.com/982065
SUSE Bug 982065
The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.
CVE-2016-4954
openSUSE 13.2:ntp-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1
openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1
important
2.5
AV:N/AC:H/Au:N/C:N/I:N/A:P
Please Install the update.
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
https://www.suse.com/security/cve/CVE-2016-4954.html
CVE-2016-4954
https://bugzilla.suse.com/982056
SUSE Bug 982056
https://bugzilla.suse.com/982066
SUSE Bug 982066
ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.
CVE-2016-4955
openSUSE 13.2:ntp-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1
openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1
important
2.5
AV:N/AC:H/Au:N/C:N/I:N/A:P
Please Install the update.
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
https://www.suse.com/security/cve/CVE-2016-4955.html
CVE-2016-4955
https://bugzilla.suse.com/982056
SUSE Bug 982056
https://bugzilla.suse.com/982067
SUSE Bug 982067
ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.
CVE-2016-4956
openSUSE 13.2:ntp-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1
openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1
important
2.5
AV:N/AC:H/Au:N/C:N/I:N/A:P
Please Install the update.
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
https://www.suse.com/security/cve/CVE-2016-4956.html
CVE-2016-4956
https://bugzilla.suse.com/977461
SUSE Bug 977461
https://bugzilla.suse.com/982056
SUSE Bug 982056
https://bugzilla.suse.com/982068
SUSE Bug 982068
ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.
CVE-2016-4957
openSUSE 13.2:ntp-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1
openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1
openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1
important
4.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
Please Install the update.
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html
https://www.suse.com/security/cve/CVE-2016-4957.html
CVE-2016-4957
https://bugzilla.suse.com/977459
SUSE Bug 977459
https://bugzilla.suse.com/982056
SUSE Bug 982056
https://bugzilla.suse.com/982064
SUSE Bug 982064