CVE-2017-6460

Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.

These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

This ntp update to version 4.2.8p10 fixes serveral issues.

This updated enables leap smearing. See /usr/share/doc/packages/ntp/README.leapsmear for details.

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

This ntp update to version 4.2.8p10 fixes the following issues:

Security issues fixed (bsc#1030050):

• CVE-2017-6464: Denial of Service via Malformed Config
• CVE-2017-6462: Buffer Overflow in DPTS Clock
• CVE-2017-6463: Authenticated DoS via Malicious Config Option
• CVE-2017-6458: Potential Overflows in ctl_put() functions
• CVE-2017-6451: Improper use of snprintf() in mx4200_send()
• CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist
• CVE-2016-9042: 0rigin (zero origin) DoS.
• ntpq_stripquotes() returns incorrect Value
• ereallocarray()/eallocarray() underused
• Copious amounts of Unused Code
• Off-by-one in Oncore GPS Receiver
• Makefile does not enforce Security Flags

Bugfixes:

• Remove spurious log messages (bsc#1014172).
• Fixing ppc and ppc64 linker issue (bsc#1031085).
• clang scan-build findings
• Support for openssl-1.1.0 without compatibility modes
• Bugfix 3072 breaks multicastclient
• forking async worker: interrupted pipe I/O
• (...) time_pps_create: Exec format error
• Incorrect Logic for Peer Event Limiting
• Change the process name of forked DNS worker
• Trap Configuration Fail
• Nothing happens if minsane < maxclock < minclock
• allow -4/-6 on restrict line with mask
• out-of-bound pointers in ctl_putsys and decode_bitflags
• Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for transactional updates.

Yihan Lian discovered that NTP incorrectly handled certain large request data values. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2519)

Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed addresses when performing rate limiting. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7426)

Matthew Van Gundy discovered that NTP incorrectly handled certain crafted broadcast mode packets. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7427, CVE-2016-7428)

Miroslav Lichvar discovered that NTP incorrectly handled certain responses. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 16.10. (CVE-2016-7429)

Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly handled origin timestamps of zero. A remote attacker could possibly use this issue to bypass the origin timestamp protection mechanism. This issue only affected Ubuntu 16.10. (CVE-2016-7431)

Brian Utterback, Sharon Goldberg and Aanchal Malhotra discovered that NTP incorrectly performed initial sync calculations. This issue only applied to Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7433)

Magnus Stubman discovered that NTP incorrectly handled certain mrulist queries. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-7434)

Matthew Van Gund discovered that NTP incorrectly handled origin timestamp checks. A remote attacker could possibly use this issue to perform a denial of service. This issue only affected Ubuntu Ubuntu 16.10, and Ubuntu 17.04. (CVE-2016-9042)

Matthew Van Gundy discovered that NTP incorrectly handled certain control mode packets. A remote attacker could use this issue to set or unset traps. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9310)

Matthew Van Gundy discovered that NTP incorrectly handled the trap service. A remote attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-9311)

It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6458)

It was discovered that NTP incorrectly handled memory when processing long variables. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 16.10 and Ubuntu 17.04. (CVE-2017-6460)

It was discovered that the NTP legacy DPTS refclock driver incorrectly handled the /dev/datum device. A local attacker could possibly use this issue to cause a denial of service. (CVE-2017-6462)

It was discovered that NTP incorrectly handled certain invalid settings in a :config directive. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6463)

It was discovered that NTP incorrectly handled certain invalid mode configuration directives. A remote authenticated user could possibly use this issue to cause NTP to crash, resulting in a denial of service. (CVE-2017-6464)