Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:2171-1

Опубликовано: 11 мая 2023
Источник: suse-cvrf

Описание

Security update for ntp

This update for ntp fixes the following issues:

Fixed multiple out of bound writes:

CVE-2023-26551 (bsc#1210386), CVE-2023-26552 (bsc#1210388), CVE-2023-26553 (bsc#1210387), CVE-2023-26554 (bsc#1210389).

Список пакетов

Image SLES12-SP5-Azure-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-Basic-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-SAP-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-SAP-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-Standard-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-EC2-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-EC2-ECS-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-EC2-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-EC2-SAP-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-EC2-SAP-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-GCE-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-GCE-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-GCE-SAP-BYOS
ntp-4.2.8p15-100.1
Image SLES12-SP5-GCE-SAP-On-Demand
ntp-4.2.8p15-100.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
ntp-4.2.8p15-100.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
ntp-4.2.8p15-100.1
SUSE Linux Enterprise Server 12 SP5
ntp-4.2.8p15-100.1
ntp-doc-4.2.8p15-100.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
ntp-4.2.8p15-100.1
ntp-doc-4.2.8p15-100.1

Ссылки

Описание

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-Basic-On-Demand:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-On-Demand:ntp-4.2.8p15-100.1
Ссылки

Описание

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-Basic-On-Demand:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-On-Demand:ntp-4.2.8p15-100.1
Ссылки

Описание

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-Basic-On-Demand:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-On-Demand:ntp-4.2.8p15-100.1
Ссылки

Описание

mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character. An adversary may be able to attack a client ntpq process, but cannot attack ntpd.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-Basic-On-Demand:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-BYOS:ntp-4.2.8p15-100.1
Image SLES12-SP5-Azure-HPC-On-Demand:ntp-4.2.8p15-100.1
Ссылки
Уязвимость SUSE-SU-2023:2171-1