This update for ntp to 4.2.8p7 fixes the following issues :
CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA:
CRYPTO-NAK DoS.
CVE-2016-1548, bsc#977461: Interleave-pivot
CVE-2016-1549, bsc#977451: Sybil vulnerability:
ephemeral association attack.
CVE-2016-1550, bsc#977464: Improve NTP security against buffer comparison timing attacks.
CVE-2016-1551, bsc#977450: Refclock impersonation vulnerability
CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig directives will cause an assertion botch in ntpd.
CVE-2016-2517, bsc#977455: remote configuration trustedkey/ requestkey/controlkey values are not properly validated.
CVE-2016-2518, bsc#977457: Crafted addpeer with hmode > 7 causes array wraparound with MATCH_ASSOC.
CVE-2016-2519, bsc#977458: ctl_getitem() return value not always checked.
This update also improves the fixes for: CVE-2015-7704, CVE-2015-7705, CVE-2015-7974
Bugs fixed :
Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2016:1278-1.
# The text itself is copyright (C) SUSE.
#
include('deprecated_nasl_level.inc');
include('compat.inc');
if (description)
{
script_id(91120);
script_version("2.18");
script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/19");
script_cve_id("CVE-2015-7704", "CVE-2015-7705", "CVE-2015-7974", "CVE-2016-1547", "CVE-2016-1548", "CVE-2016-1549", "CVE-2016-1550", "CVE-2016-1551", "CVE-2016-2516", "CVE-2016-2517", "CVE-2016-2518", "CVE-2016-2519");
script_name(english:"SUSE SLES11 Security Update : ntp (SUSE-SU-2016:1278-1)");
script_summary(english:"Checks rpm output for the updated packages.");
script_set_attribute(
attribute:"synopsis",
value:"The remote SUSE host is missing one or more security updates."
);
script_set_attribute(
attribute:"description",
value:
"This update for ntp to 4.2.8p7 fixes the following issues :
- CVE-2016-1547, bsc#977459: Validate crypto-NAKs, AKA:
CRYPTO-NAK DoS.
- CVE-2016-1548, bsc#977461: Interleave-pivot
- CVE-2016-1549, bsc#977451: Sybil vulnerability:
ephemeral association attack.
- CVE-2016-1550, bsc#977464: Improve NTP security against
buffer comparison timing attacks.
- CVE-2016-1551, bsc#977450: Refclock impersonation
vulnerability
- CVE-2016-2516, bsc#977452: Duplicate IPs on unconfig
directives will cause an assertion botch in ntpd.
- CVE-2016-2517, bsc#977455: remote configuration
trustedkey/ requestkey/controlkey values are not
properly validated.
- CVE-2016-2518, bsc#977457: Crafted addpeer with hmode >
7 causes array wraparound with MATCH_ASSOC.
- CVE-2016-2519, bsc#977458: ctl_getitem() return value
not always checked.
- This update also improves the fixes for: CVE-2015-7704,
CVE-2015-7705, CVE-2015-7974
Bugs fixed :
- Restrict the parser in the startup script to the first
occurrance of 'keys' and 'controlkey' in ntp.conf
(bsc#957226).
Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=957226"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977446"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977450"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977451"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977452"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977455"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977457"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977458"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977459"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977461"
);
script_set_attribute(
attribute:"see_also",
value:"https://bugzilla.suse.com/show_bug.cgi?id=977464"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2015-7704/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2015-7705/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2015-7974/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-1547/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-1548/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-1549/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-1550/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-1551/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-2516/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-2517/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-2518/"
);
script_set_attribute(
attribute:"see_also",
value:"https://www.suse.com/security/cve/CVE-2016-2519/"
);
# https://www.suse.com/support/update/announcement/2016/suse-su-20161278-1/
script_set_attribute(
attribute:"see_also",
value:"http://www.nessus.org/u?6b798e17"
);
script_set_attribute(
attribute:"solution",
value:
"To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :
SUSE Linux Enterprise Server 11-SP4 :
zypper in -t patch slessp4-ntp-12553=1
SUSE Linux Enterprise Debuginfo 11-SP4 :
zypper in -t patch dbgsp4-ntp-12553=1
To bring your system up-to-date, use 'zypper patch'."
);
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ntp");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:ntp-doc");
script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:11");
script_set_attribute(attribute:"vuln_publication_date", value:"2016/01/26");
script_set_attribute(attribute:"patch_publication_date", value:"2016/05/11");
script_set_attribute(attribute:"plugin_publication_date", value:"2016/05/13");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_copyright(english:"This script is Copyright (C) 2016-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_family(english:"SuSE Local Security Checks");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("rpm.inc");
if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES11)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES11", "SUSE " + os_ver);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES11" && (! preg(pattern:"^(4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES11 SP4", os_ver + " SP" + sp);
flag = 0;
if (rpm_check(release:"SLES11", sp:"4", reference:"ntp-4.2.8p7-11.1")) flag++;
if (rpm_check(release:"SLES11", sp:"4", reference:"ntp-doc-4.2.8p7-11.1")) flag++;
if (flag)
{
if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
else security_hole(0);
exit(0);
}
else
{
tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ntp");
}
Vendor | Product | Version | CPE |
---|---|---|---|
novell | suse_linux | ntp | p-cpe:/a:novell:suse_linux:ntp |
novell | suse_linux | ntp-doc | p-cpe:/a:novell:suse_linux:ntp-doc |
novell | suse_linux | 11 | cpe:/o:novell:suse_linux:11 |
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7704
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7705
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7974
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1547
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1548
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1549
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1550
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1551
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2516
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2517
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2518
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2519
www.nessus.org/u?6b798e17
bugzilla.suse.com/show_bug.cgi?id=957226
bugzilla.suse.com/show_bug.cgi?id=977446
bugzilla.suse.com/show_bug.cgi?id=977450
bugzilla.suse.com/show_bug.cgi?id=977451
bugzilla.suse.com/show_bug.cgi?id=977452
bugzilla.suse.com/show_bug.cgi?id=977455
bugzilla.suse.com/show_bug.cgi?id=977457
bugzilla.suse.com/show_bug.cgi?id=977458
bugzilla.suse.com/show_bug.cgi?id=977459
bugzilla.suse.com/show_bug.cgi?id=977461
bugzilla.suse.com/show_bug.cgi?id=977464
www.suse.com/security/cve/CVE-2015-7704/
www.suse.com/security/cve/CVE-2015-7705/
www.suse.com/security/cve/CVE-2015-7974/
www.suse.com/security/cve/CVE-2016-1547/
www.suse.com/security/cve/CVE-2016-1548/
www.suse.com/security/cve/CVE-2016-1549/
www.suse.com/security/cve/CVE-2016-1550/
www.suse.com/security/cve/CVE-2016-1551/
www.suse.com/security/cve/CVE-2016-2516/
www.suse.com/security/cve/CVE-2016-2517/
www.suse.com/security/cve/CVE-2016-2518/
www.suse.com/security/cve/CVE-2016-2519/