Stay Secure with the Latest Linux Advisories

security advisorymoderateinformation leak

SUSE: 2018:1464-1 Moderate: Ntp Security Update for Linux

An update that solves 6 vulnerabilities and has three fixes is now available. . SUSE Security Update: Security update for ntp ______________________________________________________________________________ Announcement ID: SUSE-SU-2018:1464-1 Rating: moderate References: #1034892 #1077445 #1082063 #1082210 #1083417 #1083420 #1083422 #1083424 #1083426 Cross-References: CVE-2016-1549 CVE-2018-7170 CVE-2018-7182 CVE-2018-7183 CVE-2018-7184 CVE-2018-7185 Affected Products: SUSE Linux Enterprise Server 12-LTSS ______________________________________________________________________________ An update that solves 6 vulnerabilities and has three fixes is now available. Description: This update for ntp fixes the following issues: - Update to 4.2.8p11 (bsc#1082210): * CVE-2016-1549: Sybil vulnerability: ephemeral association attack. While fixed in ntp-4.2.8p7, there are significant additional protections for this issue in 4.2.8p11. * CVE-2018-7182: ctl_getitem(): buffer read overrun leads to undefined behavior and information leak. (bsc#1083426) * CVE-2018-7170: Multiple authenticated ephemeral associations. (bsc#1083424) * CVE-2018-7184: Interleaved symmetric mode cannot recover from bad state. (bsc#1083422) * CVE-2018-7185: Unauthenticated packet can reset authenticated interleaved association. (bsc#1083420) * CVE-2018-7183: ntpq:decodearr() can write beyond its buffer limit.(bsc#1083417) - Don't use libevent's cached time stamps in sntp. (bsc#1077445) - Fix systemd migration in %pre (bsc#1034892). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 12-LTSS: zypper in -t patchSUSE-SLE-SERVER-12-2018-1000=1 Package List: - SUSE Linux Enterprise Server 12-LTSS (ppc64le s390x x86_64): ntp-4.2.8p11-46.26.2 ntp-debuginfo-4.2.8p11-46.26.2 ntp-debugsource-4.2.8p11-46.26.2 ntp-doc-4.2.8p11-46.26.2 References: https://www.suse.com/security/cve/CVE-2016-1549.html https://www.suse.com/security/cve/CVE-2018-7170.html https://www.suse.com/security/cve/CVE-2018-7182.html https://www.suse.com/security/cve/CVE-2018-7183.html https://www.suse.com/security/cve/CVE-2018-7184.html https://www.suse.com/security/cve/CVE-2018-7185.html https://bugzilla.suse.com/1034892 https://bugzilla.suse.com/1077445 https://bugzilla.suse.com/1082063 https://bugzilla.suse.com/1082210 https://bugzilla.suse.com/1083417 https://bugzilla.suse.com/1083420 https://bugzilla.suse.com/1083422 https://bugzilla.suse.com/1083424 https://bugzilla.suse.com/1083426 . Important NTP address update issued to fix vulnerabilities affecting SUSE Linux Enterprise systems. Apply latest patches swiftly to ensure your system's security. SUSE Security Update, ntp patches, Linux vulnerabilities, system updates. . LinuxSecurity.com Team

May 29, 2018 SuSE