Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2015:2058-1)
Summary:The remote host is missing an update for the 'ntp' package(s) announced via the SUSE-SU-2015:2058-1 advisory.
The remote host is missing an update for the 'ntp' package(s) announced via the SUSE-SU-2015:2058-1 advisory.

Vulnerability Insight:
This ntp update provides the following security and non security fixes:
- Update to 4.2.8p4 to fix several security issues (bsc#951608):
* CVE-2015-7871: NAK to the Future: Symmetric association authentication
bypass via crypto-NAK
* CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning
FAIL on some bogus values
* CVE-2015-7854: Password Length Memory Corruption Vulnerability
* CVE-2015-7853: Invalid length data provided by a custom refclock
driver could cause a buffer overflow
* CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability
* CVE-2015-7851 saveconfig Directory Traversal Vulnerability
* CVE-2015-7850 remote config logfile-keyfile
* CVE-2015-7849 trusted key use-after-free
* CVE-2015-7848 mode 7 loop counter underrun
* CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC
* CVE-2015-7703 configuration directives 'pidfile' and 'driftfile'
should only be allowed locally
* CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should
validate the origin timestamp field
* CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey data
packet length checks
- Use ntpq instead of deprecated ntpdc in start-ntpd (bnc#936327).
- Add a controlkey to ntp.conf to make the above work.
- Improve runtime configuration:
* Read keytype from ntp.conf
* Don't write ntp keys to syslog.
- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.
- Fix the comment regarding addserver in ntp.conf (bnc#910063).
- Remove ntp.1.gz, it wasn't installed anymore.
- Remove ntp-4.2.7-rh-manpages.tar.gz and only keep ntptime.8.gz. The rest
is partially irrelevant, partially redundant and potentially outdated
- Remove 'kod' from the restrict line in ntp.conf (bsc#944300).
- Use SHA1 instead of MD5 for symmetric keys (bsc#905885).
- Require perl-Socket6 (bsc#942441).
- Fix incomplete backporting of 'rcntp ntptimemset'.

Affected Software/OS:
'ntp' package(s) on SUSE Linux Enterprise Server 11-SP4, SUSE Linux Enterprise Desktop 11-SP4, SUSE Linux Enterprise Debuginfo 11-SP4

Please install the updated package(s).

CVSS Score:

CVSS Vector:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-7691
BugTraq ID: 77274
Debian Security Information: DSA-3388 (Google Search)
RedHat Security Advisories: RHSA-2016:0780
RedHat Security Advisories: RHSA-2016:2583
Common Vulnerability Exposure (CVE) ID: CVE-2015-7692
BugTraq ID: 77285
Common Vulnerability Exposure (CVE) ID: CVE-2015-7701
BugTraq ID: 77281
Common Vulnerability Exposure (CVE) ID: CVE-2015-7702
BugTraq ID: 77286
Common Vulnerability Exposure (CVE) ID: CVE-2015-7703
BugTraq ID: 77278
Common Vulnerability Exposure (CVE) ID: CVE-2015-7704
BugTraq ID: 77280
CERT/CC vulnerability note: VU#718152
RedHat Security Advisories: RHSA-2015:1930
RedHat Security Advisories: RHSA-2015:2520
Common Vulnerability Exposure (CVE) ID: CVE-2015-7705
BugTraq ID: 77284
Common Vulnerability Exposure (CVE) ID: CVE-2015-7848
BugTraq ID: 77275
Common Vulnerability Exposure (CVE) ID: CVE-2015-7849
BugTraq ID: 77276
Common Vulnerability Exposure (CVE) ID: CVE-2015-7850
BugTraq ID: 77279
Common Vulnerability Exposure (CVE) ID: CVE-2015-7851
Common Vulnerability Exposure (CVE) ID: CVE-2015-7852
BugTraq ID: 77288
Common Vulnerability Exposure (CVE) ID: CVE-2015-7853
BugTraq ID: 77273
Common Vulnerability Exposure (CVE) ID: CVE-2015-7854
BugTraq ID: 77277
Common Vulnerability Exposure (CVE) ID: CVE-2015-7855
BugTraq ID: 77283
Common Vulnerability Exposure (CVE) ID: CVE-2015-7871
BugTraq ID: 77287
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.