| Summary: |
<net-misc/ntp-4.2.8_p13: Crafted null dereference attack in authenticated mode 6 packet |
| Product: |
Gentoo Security
|
Reporter: |
Agostino Sarubbo <ago> |
| Component: |
Vulnerabilities | Assignee: |
Gentoo Security <security> |
| Status: |
RESOLVED
FIXED
|
|
|
| Severity: |
normal
|
CC: |
base-system
|
| Priority: |
Normal
|
Flags: |
stable-bot:
sanity-check+
|
| Version: |
unspecified | |
|
| Hardware: |
All | |
|
| OS: |
Linux | |
|
| URL: |
https://bugzilla.redhat.com/show_bug.cgi?id=1686605
|
| Whiteboard: |
A3 [glsa+ cve] |
|
Package list:
|
net-misc/ntp-4.2.8_p13
|
Runtime testing required:
|
---
|
|---|
From ${URL} : A flaw was found in ntp before version 4.2.8p13. An authenticated attacker can cause ntpd to sigsegv by triggering a NULL pointer exception. Upstream issue: http://bugs.ntp.org/show_bug.cgi?id=3565 Upstream patch: http://bk.ntp.org/ntp-stable/ntpd/ntp_control.c?PAGE=diffs&REV=5c8106e7wWtXdh0lzg1ytlWribBTcQ References: https://gitlab.com/NTPsec/ntpsec/issues/509 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.