MGASA-2015-0418

Dashboard / Vulnerabilities / MGASA-2015-0418

MGASA-2015-0418

Summary: Updated ntp package fixes security vulnerabilities

Details: Yves Younan discovered that NTP incorrectly handled logfile and keyfile directives. In a non-default configuration, a remote authenticated attacker could possibly use this issue to cause NTP to enter a loop, resulting in a denial of service (CVE-2015-7850). Yves Younan discovered that NTP incorrectly handled reference clock memory. A malicious refclock could possibly use this issue to cause NTP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2015-7853). John D "Doug" Birdwell discovered that NTP incorrectly handled decoding certain bogus values. An attacker could possibly use this issue to cause NTP to crash, resulting in a denial of service (CVE-2015-7855).

References: https://advisories.mageia.org/MGASA-2015-0418.html, https://bugs.mageia.org/show_bug.cgi?id=17041, http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner, http://www.ubuntu.com/usn/usn-2783-1/