Security update for ntp SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2020:0934-1 Final 1 1 2020-07-06T14:39:34Z current 2020-07-06T14:39:34Z 2020-07-06T14:39:34Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for ntp This update for ntp fixes the following issues: ntp was updated to 4.2.8p15 - CVE-2020-11868: Fixed an issue which a server mode packet with spoofed source address frequently send to the client ntpd could have caused denial of service (bsc#1169740). - CVE-2018-8956: Fixed an issue which could have allowed remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via spoofed mode 3 and mode 5 packets (bsc#1171355). - CVE-2020-13817: Fixed an issue which an off-path attacker with the ability to query time from victim's ntpd instance could have modified the victim's clock by a limited amount (bsc#1172651). - CVE-2020-15025: Fixed an issue which remote attacker could have caused denial of service by consuming the memory when a CMAC key was used andassociated with a CMAC algorithm in the ntp.keys (bsc#1173334). - Removed an OpenSSL version warning (bsc#992038 and bsc#1125401). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2020-934 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/ E-Mail link for openSUSE-SU-2020:0934-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1125401 SUSE Bug 1125401 https://bugzilla.suse.com/1169740 SUSE Bug 1169740 https://bugzilla.suse.com/1171355 SUSE Bug 1171355 https://bugzilla.suse.com/1172651 SUSE Bug 1172651 https://bugzilla.suse.com/1173334 SUSE Bug 1173334 https://bugzilla.suse.com/992038 SUSE Bug 992038 https://www.suse.com/security/cve/CVE-2018-8956/ SUSE CVE CVE-2018-8956 page https://www.suse.com/security/cve/CVE-2020-11868/ SUSE CVE CVE-2020-11868 page https://www.suse.com/security/cve/CVE-2020-13817/ SUSE CVE CVE-2020-13817 page https://www.suse.com/security/cve/CVE-2020-15025/ SUSE CVE CVE-2020-15025 page openSUSE Leap 15.1 ntp-4.2.8p15-lp151.2.3.1 ntp-doc-4.2.8p15-lp151.2.3.1 ntp-4.2.8p15-lp151.2.3.1 as a component of openSUSE Leap 15.1 ntp-doc-4.2.8p15-lp151.2.3.1 as a component of openSUSE Leap 15.1 ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker's behalf and send them to the attacker. CVE-2018-8956 openSUSE Leap 15.1:ntp-4.2.8p15-lp151.2.3.1 openSUSE Leap 15.1:ntp-doc-4.2.8p15-lp151.2.3.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/ https://www.suse.com/security/cve/CVE-2018-8956.html CVE-2018-8956 https://bugzilla.suse.com/1171355 SUSE Bug 1171355 ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp. CVE-2020-11868 openSUSE Leap 15.1:ntp-4.2.8p15-lp151.2.3.1 openSUSE Leap 15.1:ntp-doc-4.2.8p15-lp151.2.3.1 low 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/ https://www.suse.com/security/cve/CVE-2020-11868.html CVE-2020-11868 https://bugzilla.suse.com/1169740 SUSE Bug 1169740 ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim's ntpd instance. CVE-2020-13817 openSUSE Leap 15.1:ntp-4.2.8p15-lp151.2.3.1 openSUSE Leap 15.1:ntp-doc-4.2.8p15-lp151.2.3.1 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/ https://www.suse.com/security/cve/CVE-2020-13817.html CVE-2020-13817 https://bugzilla.suse.com/1172651 SUSE Bug 1172651 ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file. CVE-2020-15025 openSUSE Leap 15.1:ntp-4.2.8p15-lp151.2.3.1 openSUSE Leap 15.1:ntp-doc-4.2.8p15-lp151.2.3.1 moderate 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BIQMBPSMZGTUEK5KJC4HX6YOA3YJ3SL6/ https://www.suse.com/security/cve/CVE-2020-15025.html CVE-2020-15025 https://bugzilla.suse.com/1173334 SUSE Bug 1173334