Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.4.2015.2058.1
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2015:2058-1)
Summary:The remote host is missing an update for the 'ntp' package(s) announced via the SUSE-SU-2015:2058-1 advisory.
Description:Summary:
The remote host is missing an update for the 'ntp' package(s) announced via the SUSE-SU-2015:2058-1 advisory.

Vulnerability Insight:
This ntp update provides the following security and non security fixes:
- Update to 4.2.8p4 to fix several security issues (bsc#951608):
* CVE-2015-7871: NAK to the Future: Symmetric association authentication
bypass via crypto-NAK
* CVE-2015-7855: decodenetnum() will ASSERT botch instead of returning
FAIL on some bogus values
* CVE-2015-7854: Password Length Memory Corruption Vulnerability
* CVE-2015-7853: Invalid length data provided by a custom refclock
driver could cause a buffer overflow
* CVE-2015-7852 ntpq atoascii() Memory Corruption Vulnerability
* CVE-2015-7851 saveconfig Directory Traversal Vulnerability
* CVE-2015-7850 remote config logfile-keyfile
* CVE-2015-7849 trusted key use-after-free
* CVE-2015-7848 mode 7 loop counter underrun
* CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC
* CVE-2015-7703 configuration directives 'pidfile' and 'driftfile'
should only be allowed locally
* CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should
validate the origin timestamp field
* CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey data
packet length checks
- Use ntpq instead of deprecated ntpdc in start-ntpd (bnc#936327).
- Add a controlkey to ntp.conf to make the above work.
- Improve runtime configuration:
* Read keytype from ntp.conf
* Don't write ntp keys to syslog.
- Don't let 'keysdir' lines in ntp.conf trigger the 'keys' parser.
- Fix the comment regarding addserver in ntp.conf (bnc#910063).
- Remove ntp.1.gz, it wasn't installed anymore.
- Remove ntp-4.2.7-rh-manpages.tar.gz and only keep ntptime.8.gz. The rest
is partially irrelevant, partially redundant and potentially outdated
(bsc#942587).
- Remove 'kod' from the restrict line in ntp.conf (bsc#944300).
- Use SHA1 instead of MD5 for symmetric keys (bsc#905885).
- Require perl-Socket6 (bsc#942441).
- Fix incomplete backporting of 'rcntp ntptimemset'.

Affected Software/OS:
'ntp' package(s) on SUSE Linux Enterprise Server 11-SP4, SUSE Linux Enterprise Desktop 11-SP4, SUSE Linux Enterprise Debuginfo 11-SP4

Solution:
Please install the updated package(s).

CVSS Score:
7.5

CVSS Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-7691
BugTraq ID: 77274
http://www.securityfocus.com/bid/77274
Debian Security Information: DSA-3388 (Google Search)
http://www.debian.org/security/2015/dsa-3388
https://security.gentoo.org/glsa/201607-15
RedHat Security Advisories: RHSA-2016:0780
http://rhn.redhat.com/errata/RHSA-2016-0780.html
RedHat Security Advisories: RHSA-2016:2583
http://rhn.redhat.com/errata/RHSA-2016-2583.html
http://www.securitytracker.com/id/1033951
Common Vulnerability Exposure (CVE) ID: CVE-2015-7692
BugTraq ID: 77285
http://www.securityfocus.com/bid/77285
Common Vulnerability Exposure (CVE) ID: CVE-2015-7701
BugTraq ID: 77281
http://www.securityfocus.com/bid/77281
Common Vulnerability Exposure (CVE) ID: CVE-2015-7702
BugTraq ID: 77286
http://www.securityfocus.com/bid/77286
Common Vulnerability Exposure (CVE) ID: CVE-2015-7703
BugTraq ID: 77278
http://www.securityfocus.com/bid/77278
Common Vulnerability Exposure (CVE) ID: CVE-2015-7704
BugTraq ID: 77280
http://www.securityfocus.com/bid/77280
CERT/CC vulnerability note: VU#718152
https://www.kb.cert.org/vuls/id/718152
https://eprint.iacr.org/2015/1020.pdf
https://www.cs.bu.edu/~goldbe/NTPattack.html
RedHat Security Advisories: RHSA-2015:1930
http://rhn.redhat.com/errata/RHSA-2015-1930.html
RedHat Security Advisories: RHSA-2015:2520
http://rhn.redhat.com/errata/RHSA-2015-2520.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-7705
BugTraq ID: 77284
http://www.securityfocus.com/bid/77284
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
Common Vulnerability Exposure (CVE) ID: CVE-2015-7848
BugTraq ID: 77275
http://www.securityfocus.com/bid/77275
http://www.talosintelligence.com/reports/TALOS-2015-0052/
Common Vulnerability Exposure (CVE) ID: CVE-2015-7849
BugTraq ID: 77276
http://www.securityfocus.com/bid/77276
Common Vulnerability Exposure (CVE) ID: CVE-2015-7850
BugTraq ID: 77279
http://www.securityfocus.com/bid/77279
Common Vulnerability Exposure (CVE) ID: CVE-2015-7851
http://support.ntp.org/bin/view/Main/NtpBug2918
http://support.ntp.org/bin/view/Main/SecurityNotice
http://www.talosintel.com/reports/TALOS-2015-0062/
Common Vulnerability Exposure (CVE) ID: CVE-2015-7852
BugTraq ID: 77288
http://www.securityfocus.com/bid/77288
Common Vulnerability Exposure (CVE) ID: CVE-2015-7853
BugTraq ID: 77273
http://www.securityfocus.com/bid/77273
Common Vulnerability Exposure (CVE) ID: CVE-2015-7854
BugTraq ID: 77277
http://www.securityfocus.com/bid/77277
Common Vulnerability Exposure (CVE) ID: CVE-2015-7855
BugTraq ID: 77283
http://www.securityfocus.com/bid/77283
https://www.exploit-db.com/exploits/40840/
Common Vulnerability Exposure (CVE) ID: CVE-2015-7871
BugTraq ID: 77287
http://www.securityfocus.com/bid/77287
https://security.gentoo.org/glsa/201604-03
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.