critical Security update for ntp

SUSE-SLE-SERVER-12-2014-118

The network timeservice ntp was updated to fix critical security issues (bnc#910764, CERT VU#852879) * A potential remote code execution problem was found inside ntpd. The functions crypto_recv() (when using autokey authentication), ctl_putdata(), and configure() where updated to avoid buffer overflows that could be exploited. (CVE-2014-9295) * Furthermore a problem inside the ntpd error handling was found that is missing a return statement. This could also lead to a potentially attack vector. (CVE-2014-9296)

• Release Date
  Dec 19 2014
• References
  Bugzilla: 910764
  CVEs: CVE-2014-9296, CVE-2014-9295
• Type
  security
• Severity
  critical

cloud_download Downloads

SUSE Linux Enterprise Server 12 s390x

• Packages
  ntp
  Network Time Protocol daemon (version 4)

  4.2.6p5-31.1 lock rpm lock src

  ntp-doc
  Additional Package Documentation for ntp

  4.2.6p5-31.1 lock rpm

SUSE Linux Enterprise Server 12 ppc64le

• Packages
  ntp
  Network Time Protocol daemon (version 4)

  4.2.6p5-31.1 lock rpm lock src

  ntp-doc
  Additional Package Documentation for ntp

  4.2.6p5-31.1 lock rpm

SUSE Linux Enterprise Server for SAP Applications 12 x86_64

• Packages
  ntp
  Network Time Protocol daemon (version 4)

  4.2.6p5-31.1 lock rpm lock src

  ntp-doc
  Additional Package Documentation for ntp

  4.2.6p5-31.1 lock rpm