Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:2609-1

Опубликовано: 22 июн. 2023
Источник: suse-cvrf

Описание

Security update for ntp

This update for ntp fixes the following issues:

ntp was updated to 4.2.8p17:

  • Fix some regressions of 4.2.8p16

Update to 4.2.8p16:

  • [Sec 3808] Assertion failure in ntpq on malformed RT-11 date

  • [Sec 3807], bsc#1210390, CVE-2023-26555: praecis_parse() in the Palisade refclock driver has a hypothetical input buffer overflow.

  • [Sec 3767] An OOB KoD RATE value triggers an assertion when debug is enabled.

  • Multiple bug fixes and improvements. For details, see /usr/share/doc/packages/ntp/ChangeLog

    http://www.ntp.org/support/securitynotice/4_2_8-series-changelog/

  • CVE-2023-26555: Fixed assertion failure on malformed RT-11 dates (bsc#1210390).

Список пакетов

Image SLES12-SP5-Azure-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-Basic-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-HPC-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-HPC-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-SAP-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-SAP-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-Standard-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-EC2-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-EC2-ECS-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-EC2-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-EC2-SAP-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-EC2-SAP-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-GCE-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-GCE-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-GCE-SAP-BYOS
ntp-4.2.8p17-103.1
Image SLES12-SP5-GCE-SAP-On-Demand
ntp-4.2.8p17-103.1
Image SLES12-SP5-SAP-Azure-LI-BYOS-Production
ntp-4.2.8p17-103.1
Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production
ntp-4.2.8p17-103.1
SUSE Linux Enterprise Server 12 SP5
ntp-4.2.8p17-103.1
ntp-doc-4.2.8p17-103.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5
ntp-4.2.8p17-103.1
ntp-doc-4.2.8p17-103.1

Ссылки

Описание

praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write. Any attack method would be complex, e.g., with a manipulated GPS receiver.

Затронутые продукты
Image SLES12-SP5-Azure-BYOS:ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-Basic-On-Demand:ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-HPC-BYOS:ntp-4.2.8p17-103.1
Image SLES12-SP5-Azure-HPC-On-Demand:ntp-4.2.8p17-103.1
Ссылки