what you don't know can hurt you

Ubuntu Security Notice USN-3707-2

Ubuntu Security Notice USN-3707-2
Posted Jan 23, 2019
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 3707-2 - USN-3707-1 and USN-3349-1 fixed several vulnerabilities in NTP. This update provides the corresponding update for Ubuntu 12.04 ESM. Miroslav Lichvar discovered that NTP incorrectly handled certain spoofed addresses when performing rate limiting. A remote attacker could possibly use this issue to perform a denial of service. Various other issues were also addressed.

tags | advisory, remote, denial of service, spoof, vulnerability
systems | linux, ubuntu
advisories | CVE-2016-7426, CVE-2016-9310, CVE-2016-9311, CVE-2017-6462, CVE-2017-6463, CVE-2018-7183, CVE-2018-7185
MD5 | 2f54f1b535f2b9e7d16c597307f59f6d

Ubuntu Security Notice USN-3707-2

Change Mirror Download
==========================================================================
Ubuntu Security Notice USN-3707-2
January 23, 2019

ntp vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 12.04 ESM

Summary:

Several security issues were fixed in NTP.

Software Description:
- ntp: Network Time Protocol daemon and utility programs

Details:

USN-3707-1 and USN-3349-1 fixed several vulnerabilities in NTP. This
update provides the corresponding update for Ubuntu 12.04 ESM.

Original advisory details:

Miroslav Lichvar discovered that NTP incorrectly handled certain
spoofed addresses when performing rate limiting. A remote attacker
could possibly use this issue to perform a denial of service.
(CVE-2016-7426)

Matthew Van Gundy discovered that NTP incorrectly handled certain
crafted broadcast mode packets. A remote attacker could possibly use
this issue to perform a denial of service.
(CVE-2016-7427, CVE-2016-7428)

Matthew Van Gundy discovered that NTP incorrectly handled certain
control mode packets. A remote attacker could use this issue to set or
unset traps. (CVE-2016-9310)

Matthew Van Gundy discovered that NTP incorrectly handled the trap
service. A remote attacker could possibly use this issue to cause NTP
to crash, resulting in a denial of service. (CVE-2016-9311)

It was discovered that the NTP legacy DPTS refclock driver incorrectly
handled the /dev/datum device. A local attacker could possibly use
this issue to cause a denial of service. (CVE-2017-6462)

It was discovered that NTP incorrectly handled certain invalid
settings in a :config directive. A remote authenticated user could
possibly use this issue to cause NTP to crash, resulting in a denial
of service. (CVE-2017-6463)

Michael Macnair discovered that NTP incorrectly handled certain
responses. A remote attacker could possibly use this issue to execute
arbitrary code. (CVE-2018-7183)

Miroslav Lichvar discovered that NTP incorrectly handled certain
zero-origin timestamps. A remote attacker could possibly use this
issue to cause a denial of service. (CVE-2018-7185)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 ESM:
ntp 1:4.2.6.p3+dfsg-1ubuntu3.12

In general, a standard system update will make all the necessary
changes.

References:
https://usn.ubuntu.com/usn/usn-3707-2
https://usn.ubuntu.com/usn/usn-3707-1
CVE-2016-7426, CVE-2016-7427, CVE-2016-7428, CVE-2016-9310,
CVE-2016-9311, CVE-2017-6462, CVE-2017-6463, CVE-2018-7183,
CVE-2018-7185

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close