| Summary: | <net-misc/ntp-4.2.8_p8: Multiple vulnerabilities (CVE-2016-{4953,4954,4955,4956,4957}) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Kristian Fiskerstrand (RETIRED) <k_f> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | base-system |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://support.ntp.org/bin/view/Main/SecurityNotice#June_2016_ntp_4_2_8p8_NTP_Securi | ||
| Whiteboard: | A3 [glsa cve] | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 563774, 572452, 581528 | ||
Fixed version already in tree, arches, please stabilize: =net-misc/ntp-ntp-4.2.8_p8 stable arches: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86 amd64 stable Stable on alpha. Stable for PPC64. arm stable Stable for HPPA. x86 stable ppc stable sparc stable ia64 stable. Maintainer(s), please cleanup. Security, please add it to the existing request, or file a new one. This issue was resolved and addressed in GLSA 201607-15 at https://security.gentoo.org/glsa/201607-15 by GLSA coordinator Aaron Bauman (b-man). @maintainer(s), reopening for cleanup. Maintainer(s), please drop the vulnerable version(s). Please Drop: 4.2.8_p3, 4.2.8_p6, 4.2.8_p7 Any reason these still cannot be cleaned? commit 5a50c3c8835393a878e462614bdc162127de1d60 Author: Lars Wendler <polynomial-c@gentoo.org> Date: Mon Oct 10 13:36:55 2016 net-misc/ntp: Security cleanup (bug #584954). Package-Manager: portage-2.3.1 Signed-off-by: Lars Wendler <polynomial-c@gentoo.org> Thanks! |
NTF's NTP Project has been notified of the following 1 high- and 4 low-severity vulnerabilities, which are fixed in ntp-4.2.8p8. ntp-4.2.8p8 is scheduled to be released on 2 June 2016. Sec 3046 / CVE-2016-4957 / VU#321640: Crypto-NAK crash Reported by Nicolas Edet of Cisco. Sec 3045 / CVE-2016-4953 / VU#321640: Bad authentication demobilizes ephemeral associations Reported by Miroslav Lichvar of Red Hat. Sec 3044 / CVE-2016-4954 / VU#321640: Processing spoofed server packets Reported by Jakub Prokes of Red Hat. Sec 3043 / CVE-2016-4955 / VU#321640: Autokey association reset Reported by Miroslav Lichvar of Red Hat. Sec 3042 / CVE-2016-4956 / VU#321640: Broadcast interleave Reported by Miroslav Lichvar of Red Hat. Timeline: 160602: ntp-4.2.8p8 released. 160526: CERT notification, including availability of pre-release patches. See: https://www.kb.cert.org/vuls/id/321640 160524: NTP Consortium members at the Partner and Premier levels received pre-release patch access.