openSUSE Security Update : ntp (openSUSE-2017-511)

Medium Nessus Plugin ID 99700


The remote openSUSE host is missing a security update.


This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050) :

- CVE-2017-6464: Denial of Service via Malformed Config

- CVE-2017-6462: Buffer Overflow in DPTS Clock

- CVE-2017-6463: Authenticated DoS via Malicious Config Option

- CVE-2017-6458: Potential Overflows in ctl_put() functions

- CVE-2017-6451: Improper use of snprintf() in mx4200_send()

- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist

- CVE-2016-9042: 0rigin (zero origin) DoS.

- ntpq_stripquotes() returns incorrect Value

- ereallocarray()/eallocarray() underused

- Copious amounts of Unused Code

- Off-by-one in Oncore GPS Receiver

- Makefile does not enforce Security Flags

Bugfixes :

- Remove spurious log messages (bsc#1014172).

- clang scan-build findings

- Support for openssl-1.1.0 without compatibility modes

- Bugfix 3072 breaks multicastclient

- forking async worker: interrupted pipe I/O

- (...) time_pps_create: Exec format error

- Incorrect Logic for Peer Event Limiting

- Change the process name of forked DNS worker

- Trap Configuration Fail

- Nothing happens if minsane < maxclock < minclock

- allow -4/-6 on restrict line with mask

- out-of-bound pointers in ctl_putsys and decode_bitflags

- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

This update was imported from the SUSE:SLE-12-SP1:Update update project.


Update the affected ntp packages.

See Also

Plugin Details

Severity: Medium

ID: 99700

File Name: openSUSE-2017-511.nasl

Version: 3.5

Type: local

Agent: unix

Published: 2017/04/27

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P


Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:ntp, p-cpe:/a:novell:opensuse:ntp-debuginfo, p-cpe:/a:novell:opensuse:ntp-debugsource, cpe:/o:novell:opensuse:42.1, cpe:/o:novell:opensuse:42.2

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2017/04/26

Reference Information

CVE: CVE-2016-9042, CVE-2017-6451, CVE-2017-6458, CVE-2017-6460, CVE-2017-6462, CVE-2017-6463, CVE-2017-6464