982066 – (CVE-2016-4954) VUL-0: CVE-2016-4954: ntp: Processing spoofed server packets

Bug 982066 (CVE-2016-4954) - VUL-0: CVE-2016-4954: ntp: Processing spoofed server packets

Summary: VUL-0: CVE-2016-4954: ntp: Processing spoofed server packets

Status:	RESOLVED FIXED

Alias:	CVE-2016-4954

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Deadline:	2016-06-21
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:
Whiteboard:	CVSSv2:SUSE:CVE-2016-4954:2.6:(AV:N/A...
Keywords:

Depends on:	982056
Blocks:
	Show dependency tree / graph

Clone This Bug

Reported:	2016-05-27 16:36 UTC by Alexander Bergmann
Modified:	2016-08-18 15:52 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Comment 1 Swamp Workflow Management 2016-05-27 22:02:42 UTC

bugbot adjusting priority

Comment 2 Marcus Meissner 2016-05-28 11:39:48 UTC

CRD: 2016-06-02

Comment 3 Marcus Meissner 2016-06-03 01:15:56 UTC

http://support.ntp.org/bin/view/Main/NtpBug3044

 NTP Bug 3044
Processing spoofed server packets

    Date Resolved: 02 June 2016; Dev (4.3.93) 02 June 2016
    References: Sec 3044 / CVE-2016-4954 / VU#321640
    Affects: ntp-4, up to but not including ntp-4.2.8p8, and ntp-4.3.0 up to, but not including ntp-4.3.93.
    CVSS2: LOW 2.6 (AV:N/AC:H/Au:N/C:N/I:N/A:P)
    CVSS3: LOW 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
    Summary: An attacker who is able to spoof packets with correct origin timestamps from enough servers before the expected response packets arrive at the target machine can affect some peer variables and, for example, cause a false leap indication to be set.
    Mitigation:
        Implement BCP-38.
        Upgrade to 4.2.8p8, or later, from the NTP Project Download Page or the NTP Public Services Project Download Page
        Properly monitor your ntpd instances. 
    Credit: This weakness was discovered by Jakub Prokes of Red Hat.

Comment 5 Bernhard Wiedemann 2016-06-07 11:00:54 UTC

This is an autogenerated message for OBS integration:
This bug (982066) was mentioned in
https://build.opensuse.org/request/show/400418 13.2 / ntp

Comment 6 Bernhard Wiedemann 2016-06-07 14:01:47 UTC

This is an autogenerated message for OBS integration:
This bug (982066) was mentioned in
https://build.opensuse.org/request/show/400540 Factory / ntp

Comment 7 Swamp Workflow Management 2016-06-13 16:38:56 UTC

SUSE-SU-2016:1563-1: An update that solves 5 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 979302,979981,981422,982056,982064,982065,982066,982067,982068
CVE References: CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    ntp-4.2.8p8-14.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    ntp-4.2.8p8-14.1

Comment 8 Swamp Workflow Management 2016-06-14 10:11:33 UTC

SUSE-SU-2016:1568-1: An update that solves 17 vulnerabilities and has two fixes is now available.

Category: security (important)
Bug References: 957226,962960,977450,977451,977452,977455,977457,977458,977459,977461,977464,979302,979981,981422,982064,982065,982066,982067,982068
CVE References: CVE-2015-7704,CVE-2015-7705,CVE-2015-7974,CVE-2016-1547,CVE-2016-1548,CVE-2016-1549,CVE-2016-1550,CVE-2016-1551,CVE-2016-2516,CVE-2016-2517,CVE-2016-2518,CVE-2016-2519,CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
SUSE Linux Enterprise Server 12 (src):    ntp-4.2.8p8-46.8.1
SUSE Linux Enterprise Desktop 12 (src):    ntp-4.2.8p8-46.8.1

Comment 9 Swamp Workflow Management 2016-06-14 15:31:32 UTC

An update workflow for this issue was started.
This issue was rated as important.
Please submit fixed packages until 2016-06-21.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62822

Comment 10 Swamp Workflow Management 2016-06-15 09:09:39 UTC

openSUSE-SU-2016:1583-1: An update that solves 5 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 979302,979981,981422,982056,982064,982065,982066,982067,982068
CVE References: CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
openSUSE 13.2 (src):    ntp-4.2.8p8-25.18.1

Comment 11 Swamp Workflow Management 2016-06-15 12:09:24 UTC

SUSE-SU-2016:1584-1: An update that solves 5 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 979302,981422,982056,982064,982065,982066,982067,982068
CVE References: CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
SUSE Linux Enterprise Server 11-SP4 (src):    ntp-4.2.8p8-14.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ntp-4.2.8p8-14.1

Comment 12 Swamp Workflow Management 2016-06-17 12:09:43 UTC

SUSE-SU-2016:1602-1: An update that solves 5 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 979302,981422,982056,982064,982065,982066,982067,982068
CVE References: CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
SUSE OpenStack Cloud 5 (src):    ntp-4.2.8p8-47.3
SUSE Manager Proxy 2.1 (src):    ntp-4.2.8p8-47.3
SUSE Manager 2.1 (src):    ntp-4.2.8p8-47.3
SUSE Linux Enterprise Server 11-SP3-LTSS (src):    ntp-4.2.8p8-47.3
SUSE Linux Enterprise Server 11-SP2-LTSS (src):    ntp-4.2.8p8-47.3
SUSE Linux Enterprise Debuginfo 11-SP3 (src):    ntp-4.2.8p8-47.3
SUSE Linux Enterprise Debuginfo 11-SP2 (src):    ntp-4.2.8p8-47.3

Comment 13 Swamp Workflow Management 2016-06-20 19:08:53 UTC

openSUSE-SU-2016:1636-1: An update that solves 5 vulnerabilities and has four fixes is now available.

Category: security (important)
Bug References: 979302,979981,981422,982056,982064,982065,982066,982067,982068
CVE References: CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
openSUSE Leap 42.1 (src):    ntp-4.2.8p8-24.1

Comment 14 Swamp Workflow Management 2016-07-29 17:16:21 UTC

SUSE-SU-2016:1912-1: An update that solves 43 vulnerabilities and has 9 fixes is now available.

Category: security (important)
Bug References: 782060,784760,905885,910063,916617,920183,920238,920893,920895,920905,924202,926510,936327,943218,943221,944300,951351,951559,951629,952611,957226,962318,962784,962802,962960,962966,962970,962988,962995,963000,963002,975496,977450,977451,977452,977455,977457,977458,977459,977461,977464,979302,981422,982056,982064,982065,982066,982067,982068,988417,988558,988565
CVE References: CVE-2015-1798,CVE-2015-1799,CVE-2015-5194,CVE-2015-5300,CVE-2015-7691,CVE-2015-7692,CVE-2015-7701,CVE-2015-7702,CVE-2015-7703,CVE-2015-7704,CVE-2015-7705,CVE-2015-7848,CVE-2015-7849,CVE-2015-7850,CVE-2015-7851,CVE-2015-7852,CVE-2015-7853,CVE-2015-7854,CVE-2015-7855,CVE-2015-7871,CVE-2015-7973,CVE-2015-7974,CVE-2015-7975,CVE-2015-7976,CVE-2015-7977,CVE-2015-7978,CVE-2015-7979,CVE-2015-8138,CVE-2015-8158,CVE-2016-1547,CVE-2016-1548,CVE-2016-1549,CVE-2016-1550,CVE-2016-1551,CVE-2016-2516,CVE-2016-2517,CVE-2016-2518,CVE-2016-2519,CVE-2016-4953,CVE-2016-4954,CVE-2016-4955,CVE-2016-4956,CVE-2016-4957
Sources used:
SUSE Linux Enterprise Server 10 SP4 LTSS (src):    ntp-4.2.8p8-0.7.1

Comment 15 Marcus Meissner 2016-08-01 08:40:13 UTC

all released