| Summary: | <net-misc/ntp-4.2.8_p6: multiple vulnerabilities | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | base-system, josh |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://support.ntp.org/bin/view/Main/SecurityNotice#January_2016_NTP_4_2_8p6_Securit | ||
| Whiteboard: | A3 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | 584954 | ||
| Bug Blocks: | |||
commit b6d7a4c97b180507bfcfc6481bd9111cf6a31830 Author: Lars Wendler <polynomial-c@gentoo.org> Date: Wed Jan 20 22:06:54 2016 net-misc/ntp: Security bump (bug #572452). Package-Manager: portage-2.2.27 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> Arches please test and mark stable =net-misc/ntp-4.2.8_p6 with target KEYWORDS: alpha amd64 arm ~arm64 hppa ia64 ~m68k ~mips ppc ppc64 ~s390 ~sh sparc x86 ~amd64-fbsd ~sparc-fbsd ~x86-fbsd ~x86-freebsd ~amd64-linux ~ia64-linux ~x86-linux ~m68k-mint amd64 stable It fails here on x86 during the tests if USE="-*". It works if just USE="ssl" is set. This is a regression. Stable for HPPA PPC64. Stable on alpha. arm stable New GLSA request filed x86 stable ppc stable sparc stable ia64 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one. This issue was resolved and addressed in GLSA 201607-15 at https://security.gentoo.org/glsa/201607-15 by GLSA coordinator Aaron Bauman (b-man). |
From ${URL} : Bug 2948 / CVE-2015-8158: Potential Infinite Loop in ntpq Reported by Cisco ASIG Bug 2945 / CVE-2015-8138: origin: Zero Origin Timestamp Bypass Reported by Cisco ASIG Bug 2942 / CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated broadcast mode Reported by Cisco ASIG Bug 2940 / CVE-2015-7978: Stack exhaustion in recursive traversal of restriction list Reported by Cisco ASIG Bug 2939 / CVE-2015-7977: reslist NULL pointer dereference Reported by Cisco ASIG Bug 2938 / CVE-2015-7976: ntpq saveconfig command allows dangerous characters in filenames Reported by Cisco ASIG Bug 2937 / CVE-2015-7975: nextvar() missing length check Reported by Cisco ASIG Bug 2936 / CVE-2015-7974: Skeleton Key: Missing key check allows impersonation between authenticated peers Reported by Cisco ASIG Bug 2935 / CVE-2015-7973: Deja Vu: Replay attack on authenticated broadcast mode Reported by Cisco ASIG. Additionally, mitigations are published for the following two issues: Bug 2947 / CVE-2015-8140: ntpq vulnerable to replay attacks Reported by Cisco ASIG Bug 2946 / CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin Reported by Cisco ASIG @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.