From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthias Fischer <matthias.fischer@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] ntp: Update to 4.2.8p11
Date: Wed, 07 Mar 2018 19:19:04 +0100
Message-ID: <20180307181904.1772-1-matthias.fischer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1514211065455940712=="
List-Id: <development.lists.ipfire.org>

--===============1514211065455940712==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

For details see:
http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities

"This release addresses five security issues in ntpd:

	LOW/MEDIUM: Sec 3012 / CVE-2016-1549 / VU#961909: Sybil vulnerability: ephem=
eral
	association attack
		While fixed in ntp-4.2.8p7, there are significant additional protections for
		this issue in 4.2.8p11.
		Reported by Matt Van Gundy of Cisco.
	INFO/MEDIUM: Sec 3412 / CVE-2018-7182 / VU#961909: ctl_getitem(): buffer rea=
d overrun
	leads to undefined behavior and information leak
		Reported by Yihan Lian of Qihoo 360.
	LOW: Sec 3415 / CVE-2018-7170 / VU#961909: Multiple authenticated ephemeral =
associations
		Reported on the questions@ list.
	LOW: Sec 3453 / CVE-2018-7184 / VU#961909: Interleaved symmetric mode cannot=
 recover
	from bad state
		Reported by Miroslav Lichvar of Red Hat.
	LOW/MEDIUM: Sec 3454 / CVE-2018-7185 / VU#961909: Unauthenticated packet can=
 reset
	authenticated interleaved association
		Reported by Miroslav Lichvar of Red Hat.

one security issue in ntpq:

	MEDIUM: Sec 3414 / CVE-2018-7183 / VU#961909: ntpq:decodearr() can write bey=
ond its
	buffer limit
		Reported by Michael Macnair of Thales-esecurity.com.

and provides over 33 bugfixes and 32 other improvements."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
---
 lfs/ntp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lfs/ntp b/lfs/ntp
index 1f1c5244d..9c5e772ac 100644
--- a/lfs/ntp
+++ b/lfs/ntp
@@ -1,7 +1,7 @@
 ############################################################################=
###
 #                                                                           =
  #
 # IPFire.org - A linux based firewall                                       =
  #
-# Copyright (C) 2007-2017  IPFire Team  <info(a)ipfire.org>                 =
    #
+# Copyright (C) 2007-2018  IPFire Team  <info(a)ipfire.org>                 =
    #
 #                                                                           =
  #
 # This program is free software: you can redistribute it and/or modify      =
  #
 # it under the terms of the GNU General Public License as published by      =
  #
@@ -24,7 +24,7 @@
=20
 include Config
=20
-VER        =3D 4.2.8p10
+VER        =3D 4.2.8p11
=20
 THISAPP    =3D ntp-$(VER)
 DL_FILE    =3D $(THISAPP).tar.gz
@@ -40,7 +40,7 @@ objects =3D $(DL_FILE)
=20
 $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
=20
-$(DL_FILE)_MD5 =3D 745384ed0dedb3f66b33fe84d66466f9
+$(DL_FILE)_MD5 =3D 00950ca2855579541896513e78295361
=20
 install : $(TARGET)
=20
--=20
2.16.2


--===============1514211065455940712==--