Security update for ntp SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:1583-1 Final 1 1 2016-06-15T06:03:16Z current 2016-06-15T06:03:16Z 2016-06-15T06:03:16Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ntp ntp was updated to fix five security issues. These security issues were fixed: - CVE-2016-4953: Bad authentication demobilizes ephemeral associations (bsc#982065). - CVE-2016-4954: Processing spoofed server packets (bsc#982066). - CVE-2016-4955: Autokey association reset (bsc#982067). - CVE-2016-4956: Broadcast interleave (bsc#982068). - CVE-2016-4957: CRYPTO_NAK crash (bsc#982064). These non-security issues were fixed: - bsc#979302: Change the process name of the forking DNS worker process to avoid the impression that ntpd is started twice. - bsc#979981: ntp-wait does not accept fractional seconds, so use 1 instead of 0.2 in ntp-wait.service. - bsc#981422: Don't ignore SIGCHILD because it breaks wait(). - Separate the creation of ntp.keys and key #1 in it to avoid problems when upgrading installations that have the file, but no key #1, which is needed e.g. by "rcntp addserver". The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html E-Mail link for openSUSE-SU-2016:1583-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 ntp-4.2.8p8-25.18.1 ntp-debuginfo-4.2.8p8-25.18.1 ntp-debugsource-4.2.8p8-25.18.1 ntp-doc-4.2.8p8-25.18.1 ntp-4.2.8p8-25.18.1 as a component of openSUSE 13.2 ntp-debuginfo-4.2.8p8-25.18.1 as a component of openSUSE 13.2 ntp-debugsource-4.2.8p8-25.18.1 as a component of openSUSE 13.2 ntp-doc-4.2.8p8-25.18.1 as a component of openSUSE 13.2 ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time. CVE-2016-4953 openSUSE 13.2:ntp-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1 openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1 important 2.5 AV:N/AC:H/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html https://www.suse.com/security/cve/CVE-2016-4953.html CVE-2016-4953 https://bugzilla.suse.com/962784 SUSE Bug 962784 https://bugzilla.suse.com/977459 SUSE Bug 977459 https://bugzilla.suse.com/982056 SUSE Bug 982056 https://bugzilla.suse.com/982065 SUSE Bug 982065 The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication. CVE-2016-4954 openSUSE 13.2:ntp-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1 openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1 important 2.5 AV:N/AC:H/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html https://www.suse.com/security/cve/CVE-2016-4954.html CVE-2016-4954 https://bugzilla.suse.com/982056 SUSE Bug 982056 https://bugzilla.suse.com/982066 SUSE Bug 982066 ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time. CVE-2016-4955 openSUSE 13.2:ntp-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1 openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1 important 2.5 AV:N/AC:H/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html https://www.suse.com/security/cve/CVE-2016-4955.html CVE-2016-4955 https://bugzilla.suse.com/982056 SUSE Bug 982056 https://bugzilla.suse.com/982067 SUSE Bug 982067 ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548. CVE-2016-4956 openSUSE 13.2:ntp-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1 openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1 important 2.5 AV:N/AC:H/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html https://www.suse.com/security/cve/CVE-2016-4956.html CVE-2016-4956 https://bugzilla.suse.com/977461 SUSE Bug 977461 https://bugzilla.suse.com/982056 SUSE Bug 982056 https://bugzilla.suse.com/982068 SUSE Bug 982068 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547. CVE-2016-4957 openSUSE 13.2:ntp-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debuginfo-4.2.8p8-25.18.1 openSUSE 13.2:ntp-debugsource-4.2.8p8-25.18.1 openSUSE 13.2:ntp-doc-4.2.8p8-25.18.1 important 4.9 AV:N/AC:L/Au:N/C:N/I:N/A:P Please Install the update. http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00023.html https://www.suse.com/security/cve/CVE-2016-4957.html CVE-2016-4957 https://bugzilla.suse.com/977459 SUSE Bug 977459 https://bugzilla.suse.com/982056 SUSE Bug 982056 https://bugzilla.suse.com/982064 SUSE Bug 982064