Vulnerability   
Search   
    Search 211766 CVE descriptions
and 97459 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.1.4.2016.1175.1
Category:SuSE Local Security Checks
Title:SUSE: Security Advisory (SUSE-SU-2016:1175-1)
Summary:The remote host is missing an update for the 'ntp' package(s) announced via the SUSE-SU-2016:1175-1 advisory.
Description:Summary:
The remote host is missing an update for the 'ntp' package(s) announced via the SUSE-SU-2016:1175-1 advisory.

Vulnerability Insight:
ntp was updated to version 4.2.8p6 to fix 12 security issues.
These security issues were fixed:
- CVE-2015-8158: Fixed potential infinite loop in ntpq (bsc#962966).
- CVE-2015-8138: Zero Origin Timestamp Bypass (bsc#963002).
- CVE-2015-7979: Off-path Denial of Service (DoS) attack on authenticated
broadcast mode (bsc#962784).
- CVE-2015-7978: Stack exhaustion in recursive traversal of restriction
list (bsc#963000).
- CVE-2015-7977: reslist NULL pointer dereference (bsc#962970).
- CVE-2015-7976: ntpq saveconfig command allows dangerous characters in
filenames (bsc#962802).
- CVE-2015-7975: nextvar() missing length check (bsc#962988).
- CVE-2015-7974: Skeleton Key: Missing key check allows impersonation
between authenticated peers (bsc#962960).
- CVE-2015-7973: Replay attack on authenticated broadcast mode
(bsc#962995).
- CVE-2015-8140: ntpq vulnerable to replay attacks (bsc#962994).
- CVE-2015-8139: Origin Leak: ntpq and ntpdc, disclose origin (bsc#962997).
- CVE-2015-5300: MITM attacker could have forced ntpd to make a step
larger than the panic threshold (bsc#951629).
These non-security issues were fixed:
- fate#320758 bsc#975981: Enable compile-time support for MS-SNTP
(--enable-ntp-signd). This replaces the w32 patches in 4.2.4 that added
the authreg directive.
- bsc#962318: Call /usr/sbin/sntp with full path to synchronize in
start-ntpd. When run as cron job, /usr/sbin/ is not in the path, which
caused the synchronization to fail.
- bsc#782060: Speedup ntpq.
- bsc#916617: Add /var/db/ntp-kod.
- bsc#956773: Add ntp-ENOBUFS.patch to limit a warning that might happen
quite a lot on loaded systems.
- bsc#951559,bsc#975496: Fix the TZ offset output of sntp during DST.
- Add ntp-fork.patch and build with threads disabled to allow name
resolution even when running chrooted.
- bsc#784760: Remove local clock from default configuration

Affected Software/OS:
'ntp' package(s) on SUSE Linux Enterprise Server 11-SP4, SUSE Linux Enterprise Debuginfo 11-SP4

Solution:
Please install the updated package(s).

CVSS Score:
5.8

CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:P

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2015-5300
BugTraq ID: 77312
http://www.securityfocus.com/bid/77312
Debian Security Information: DSA-3388 (Google Search)
http://www.debian.org/security/2015/dsa-3388
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170684.html
http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177507.html
FreeBSD Security Advisory: FreeBSD-SA-16:09
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:02.ntp.asc
https://ics-cert.us-cert.gov/advisories/ICSA-15-356-01
https://www.cs.bu.edu/~goldbe/NTPattack.html
http://seclists.org/bugtraq/2016/Feb/164
RedHat Security Advisories: RHSA-2015:1930
http://rhn.redhat.com/errata/RHSA-2015-1930.html
http://www.securitytracker.com/id/1034670
SuSE Security Announcement: SUSE-SU:2016:1175 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00059.html
SuSE Security Announcement: SUSE-SU:2016:1177 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00060.html
SuSE Security Announcement: SUSE-SU:2016:1247 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00020.html
SuSE Security Announcement: SUSE-SU:2016:1311 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
SuSE Security Announcement: SUSE-SU:2016:1912 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
SuSE Security Announcement: SUSE-SU:2016:2094 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
SuSE Security Announcement: openSUSE-SU:2016:1292 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00038.html
SuSE Security Announcement: openSUSE-SU:2016:1423 (Google Search)
http://lists.opensuse.org/opensuse-updates/2016-05/msg00114.html
http://www.ubuntu.com/usn/USN-2783-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-7973
BugTraq ID: 81963
http://www.securityfocus.com/bid/81963
CERT/CC vulnerability note: VU#718152
https://www.kb.cert.org/vuls/id/718152
Cisco Security Advisory: 20160120 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products - January 2016
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160127-ntpd
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:09.ntp.asc
https://security.gentoo.org/glsa/201607-15
http://www.securitytracker.com/id/1034782
SuSE Security Announcement: SUSE-SU-2016:1175 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:1177 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:1247 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:1311 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:1912 (Google Search)
SuSE Security Announcement: SUSE-SU-2016:2094 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:1292 (Google Search)
SuSE Security Announcement: openSUSE-SU-2016:1423 (Google Search)
http://www.ubuntu.com/usn/USN-3096-1
Common Vulnerability Exposure (CVE) ID: CVE-2015-7974
BugTraq ID: 81960
http://www.securityfocus.com/bid/81960
Debian Security Information: DSA-3629 (Google Search)
http://www.debian.org/security/2016/dsa-3629
http://www.talosintel.com/reports/TALOS-2016-0071/
https://us-cert.cisa.gov/ics/advisories/icsa-21-103-11
RedHat Security Advisories: RHSA-2016:2583
http://rhn.redhat.com/errata/RHSA-2016-2583.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-7975
BugTraq ID: 81959
http://www.securityfocus.com/bid/81959
Common Vulnerability Exposure (CVE) ID: CVE-2015-7976
Common Vulnerability Exposure (CVE) ID: CVE-2015-7977
BugTraq ID: 81815
http://www.securityfocus.com/bid/81815
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html
RedHat Security Advisories: RHSA-2016:0780
http://rhn.redhat.com/errata/RHSA-2016-0780.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-7978
BugTraq ID: 81962
http://www.securityfocus.com/bid/81962
Common Vulnerability Exposure (CVE) ID: CVE-2015-7979
BugTraq ID: 81816
http://www.securityfocus.com/bid/81816
RedHat Security Advisories: RHSA-2016:1141
https://access.redhat.com/errata/RHSA-2016:1141
RedHat Security Advisories: RHSA-2016:1552
http://rhn.redhat.com/errata/RHSA-2016-1552.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-8138
BugTraq ID: 81811
http://www.securityfocus.com/bid/81811
Cisco Security Advisory: 20160428 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: April 2016
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160428-ntpd
Cisco Security Advisory: 20161123 Multiple Vulnerabilities in Network Time Protocol Daemon Affecting Cisco Products: November 2016
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20161123-ntpd
RedHat Security Advisories: RHSA-2016:0063
http://rhn.redhat.com/errata/RHSA-2016-0063.html
Common Vulnerability Exposure (CVE) ID: CVE-2015-8139
BugTraq ID: 82105
http://www.securityfocus.com/bid/82105
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/K3EYJQHJZ2KTVQ7ICEFHXTLZ36MRASWX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORAMN3Q7TVJ54MBYF75XCJOE3DP7LYHT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNWGCQLW2VY72NIUYMJOCAKJKTXHDUK2/
Common Vulnerability Exposure (CVE) ID: CVE-2015-8140
Common Vulnerability Exposure (CVE) ID: CVE-2015-8158
BugTraq ID: 81814
http://www.securityfocus.com/bid/81814
CopyrightCopyright (C) 2021 Greenbone Networks GmbH

This is only one of 97459 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.