Security update for ntp
This update for NTP to version 4.2.8p12 fixes the following vulnerabilities (bsc#1111853):
- CVE-2018-12327: Fixed stack buffer overflow in the openhost() command-line call of NTPQ/NTPDC. (bsc#1098531)
- CVE-2018-7170: Add further tweaks to improve the fix for the ephemeral association time spoofing additional protection (bsc#1083424)
Please also see https://www.nwtime.org/network-time-foundation-publishes-ntp-4-2-8p12/ for more information.
This update was imported from the SUSE:SLE-12-SP1:Update update project.
-
Submitted by
Reinhard Max (rmax)
Fixed bugs
bnc#1083424
VUL-1: CVE-2018-7170: ntp: Ephemeral association time spoofing additional protection
bnc#1098531
VUL-1: CVE-2018-12327: ntp: Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows anattacker to achieve code execution or escalate to higher privileges via a longstring as the argument for an IPv4 or IPv6 command-li
bnc#1111853
VUL-1: ntp: ntp-4.2.8p12 bugfix and security release
