Path to this page:
./
net/ntp4,
Network Time Protocol Version 4
Branch: pkgsrc-2015Q3,
Version: 4.2.8p4nb1,
Package name: ntp-4.2.8p4nb1,
Maintainer: pkgsrc-usersThis release of the NTP Version 4 (NTPv4) daemon for Unix incorporates
new features and refinements to the NTP Version 3 (NTPv3) algorithms.
However, it continues the tradition of retaining backwards compatibility
with older versions.
Required to run:[
lang/perl5]
Package options: inet6
Master sites:
SHA1: a30f61f87b219ab3613def9e27f5c8e91ce38b0a
RMD160: 94ab0e190f37c55700978a1555473a308e7175e6
Filesize: 6938.332 KB
Version history: (Expand)
- (2015-11-24) Updated to version: ntp-4.2.8p4nb1
- (2015-10-27) Updated to version: ntp-4.2.8p4
- (2015-09-30) Package added to pkgsrc.se, version ntp-4.2.8p3 (created)
CVS history: (Expand)
2015-11-24 19:25:39 by Benny Siegert | Files touched by this commit (5) | |
Log message:
Pullup ticket #4861 - requested by taca
net/ntp4: build fix
Revisions pulled up:
- net/ntp4/Makefile 1.89
- net/ntp4/distinfo 1.24
- net/ntp4/patches/patch-aa deleted
- net/ntp4/patches/patch-include-ntp__syscall.h 1.1
- net/ntp4/patches/patch-ntpd-ntpd.c 1.1
---
Module Name: pkgsrc
Committed By: christos
Date: Thu Oct 29 11:23:47 UTC 2015
Added Files:
pkgsrc/net/ntp4/patches: patch-include-ntp__syscall.h patch-ntpd-ntpd.c
Removed Files:
pkgsrc/net/ntp4/patches: patch-aa
Log message:
- rename patch-aa to follow not so new anymore convention
- apply the "warmup" patch only on linux. should fix the build on \
netbsd-6
---
Module Name: pkgsrc
Committed By: christos
Date: Thu Oct 29 11:28:44 UTC 2015
Modified Files:
pkgsrc/net/ntp4: Makefile distinfo
Log message:
update checksum and bump revision
|
2015-10-27 20:07:03 by Benny Siegert | Files touched by this commit (5) |
Log message:
Pullup ticket #4846 - requested by taca
net/ntp4: security fix
Revisions pulled up:
- net/ntp4/Makefile 1.88
- net/ntp4/PLIST 1.20
- net/ntp4/distinfo 1.23
- net/ntp4/patches/patch-configure deleted
- net/ntp4/patches/patch-sntp_configure deleted
---
Module Name: pkgsrc
Committed By: taca
Date: Fri Oct 23 03:43:31 UTC 2015
Modified Files:
pkgsrc/net/ntp4: Makefile PLIST distinfo
Removed Files:
pkgsrc/net/ntp4/patches: patch-configure patch-sntp_configure
Log message:
Update ntp4 to 4.2.8p4.
pkgsrc change:
* Remove duplicated HTML documents.
* Install some addtional documents.
Changes are too many to write here, please refer NEWS files and this
release fixes security problems.
October 2015 NTP Security Vulnerability Announcement (Medium)
NTF's NTP Project has been notified of the following 13 low- and
medium-severity vulnerabilities that are fixed in ntp-4.2.8p4, released on
Wednesday, 21 October 2015:
* Bug 2941 CVE-2015-7871 NAK to the Future: Symmetric association
authentication bypass via crypto-NAK (Cisco ASIG)
* Bug 2922 CVE-2015-7855 decodenetnum() will ASSERT botch instead of returning
FAIL on some bogus values (IDA)
* Bug 2921 CVE-2015-7854 Password Length Memory Corruption
Vulnerability. (Cisco TALOS)
* Bug 2920 CVE-2015-7853 Invalid length data provided by a custom refclock
driver could cause a buffer overflow. (Cisco TALOS)
* Bug 2919 CVE-2015-7852 ntpq atoascii() Memory Corruption
Vulnerability. (Cisco TALOS)
* Bug 2918 CVE-2015-7851 saveconfig Directory Traversal
Vulnerability. (OpenVMS) (Cisco TALOS)
* Bug 2917 CVE-2015-7850 remote config logfile-keyfile. (Cisco TALOS)
* Bug 2916 CVE-2015-7849 trusted key use-after-free. (Cisco TALOS)
* Bug 2913 CVE-2015-7848 mode 7 loop counter underrun. (Cisco TALOS)
* Bug 2909 CVE-2015-7701 Slow memory leak in CRYPTO_ASSOC. (Tenable)
* Bug 2902 : CVE-2015-7703 configuration directives "pidfile" and \
"driftfile"
should only be allowed locally. (RedHat)
* Bug 2901 : CVE-2015-7704, CVE-2015-7705 Clients that receive a KoD should
validate the origin timestamp field. (Boston University)
* Bug 2899 : CVE-2015-7691, CVE-2015-7692, CVE-2015-7702 Incomplete autokey
data packet length checks. (Tenable)
The only generally-exploitable bug in the above list is the crypto-NAK bug,
which has a CVSS2 score of 6.4.
Additionally, three bugs that have already been fixed in ntp-4.2.8 but were
not fixed in ntp-4.2.6 as it was EOL'd have a security component, but are all
below 1.8 CVSS score, so we're reporting them here:
* Bug 2382 : Peer precision < -31 gives division by zero
* Bug 1774 : Segfaults if cryptostats enabled when built without OpenSSL
* Bug 1593 : ntpd abort in free() with logconfig syntax error
|