SUSE-SU-2018:3356-1

MEDIUM4.0

Security update for ntp

Published Oct 23, 2018

Modified 7 years ago

Fix available

Details

Description of the patch:

NTP was updated to 4.2.8p12 (bsc#1111853):

CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)

Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.

Affected Packages

ntp

SUSE Linux Enterprise Point of Sale 11 SP3SUSE Linux Enterprise Server 11 SP3SUSE Linux Enterprise Server 11 SP3-LTSSSUSE Linux Enterprise Server 11 SP3-TERADATA

Fixed in:

4.2.8p12-48.21.1

ntp-doc

SUSE Linux Enterprise Point of Sale 11 SP3SUSE Linux Enterprise Server 11 SP3SUSE Linux Enterprise Server 11 SP3-LTSSSUSE Linux Enterprise Server 11 SP3-TERADATA

Fixed in:

4.2.8p12-48.21.1

References

ADVISORY

https://bugzilla.suse.com/1083424

ADVISORY

https://bugzilla.suse.com/1098531

ADVISORY

https://bugzilla.suse.com/1111853

ADVISORY

https://lists.suse.com/pipermail/sle-security-updates/2018-October/004776.html

ADVISORY