Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2017-6460 (GCVE-0-2017-6460)
Vulnerability from cvelistv5 – Published: 2017-03-27 17:00 – Updated: 2024-08-05 15:33- n/a
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:33:19.058Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1038123",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id/1038123"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.apple.com/HT208144"
},
{
"name": "97052",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/97052"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-02-17T16:03:46.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1038123",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id/1038123"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.apple.com/HT208144"
},
{
"name": "97052",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/97052"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6460",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1038123",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038123"
},
{
"name": "https://support.apple.com/HT208144",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208144"
},
{
"name": "97052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97052"
},
{
"name": "http://support.ntp.org/bin/view/Main/NtpBug3377",
"refsource": "CONFIRM",
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"name": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu",
"refsource": "CONFIRM",
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us",
"refsource": "CONFIRM",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"name": "https://security.paloaltonetworks.com/CVE-2017-6460",
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6460",
"datePublished": "2017-03-27T17:00:00.000Z",
"dateReserved": "2017-03-03T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:33:19.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*\", \"matchCriteriaId\": \"EE002C76-406D-4F22-B738-E17BDEA70BCC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C1CCF6F-74C6-42D7-B88B-36ED73BB1F8D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B23D9009-DF45-44C1-80DF-CEEC9B9E3F20\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"43921601-667E-4415-83BE-E5B39D969BD3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"75DD9C02-0C46-4785-8D77-C5465E4ED967\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A497BADE-0516-494F-89FA-EAFC6AD17F7A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4298439A-EAF2-4CAA-990B-4AA37E7A0E8D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"30E9C822-C04A-4908-9596-76F9FB561206\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"12EBD400-8EC1-4F9C-B600-85B8FF3BDEA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BE6CFF4C-2620-4FD6-91A2-C0D0DAA4287D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"842963D1-C78C-48B5-A8D2-BC018854E5CB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"121ED6C5-8985-4DEF-9040-2AC63582E596\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"566B4B99-8B4F-4ED8-B2DC-D90EC71ECB99\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"68499DA4-64EF-412F-A434-8E0F78D77CE9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"836C5AC9-463F-4703-81B9-7B5484F47A5F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FED14811-8F49-4796-BADD-DB7973EC32DF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D4EB2830-ADE5-4C87-964E-16748BF88EF6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C0284FD-2933-4160-80D2-53B32CD73287\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9AB963A-7284-433F-9890-5AE402E4E000\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EEDEFF7A-D964-4D9A-93BF-41E9D16EA793\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C434153-911C-4F07-ADD0-0EAB47F96E89\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8183B043-8B96-4A8B-A5C9-544D4F1CED8D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6DE349AB-44CB-4263-80CE-59DFD572B363\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3DB55DF6-567F-4B6A-81E1-9013914416D9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.23:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80727B0B-AB5E-46CC-9DDF-F319C2D9B242\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.24:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0755962-2D5F-41E6-9BDB-C2ECBCCD2818\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.25:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2EBAADB5-FA32-4CF9-A4B2-51EEA300B0EC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.26:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A202FDAD-D757-4850-9D1E-C31B0F3BA718\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.27:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6A345D7-DFC0-4E0D-AAAB-8206C35F63D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.28:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C4069EF5-DC7D-4487-8636-AC2EAB17BAC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.29:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"73DF3A5C-F1D9-468E-BD08-5E2578898DEA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0858AE44-4B0A-4941-B4A8-937B557D1448\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"979C84FF-CB21-4819-B3CA-1A55FDF20BD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"94709B39-C394-4B44-A362-9429F4CB9D50\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2E4526AC-6BCC-43A5-B501-263D0ED0655B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.34:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E04FF6B4-CD1C-4AC1-B286-D6AB705D680B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.35:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FAFA0C8-1349-43A4-BDAC-3B5A601B9FDE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.36:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6BA130B1-DD20-4E98-963F-61E85A09E29E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.37:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9AAC9B73-5020-47C9-803E-ABB6162AADE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.38:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D2A6B7B5-3AC9-4442-BD91-3783C2B4235C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.39:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D72F5C09-520B-486C-AD9A-9CBBFE6487CA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.40:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"097DED37-D3F3-45C4-B131-1C4294406722\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.41:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"85A4F607-0A9D-4F84-B50D-28C54E6EDC06\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.42:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C689CAF-632A-4FF2-8C86-541EEDD574E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.43:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7B0ACF5B-BBA9-4B6C-B19D-B8AEF7212781\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.44:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E09C8254-73DC-4AFA-A250-A8192DC917F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.45:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D344FA12-3C5F-418B-9209-EA8BDD230074\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.46:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1C3A62A-C6F6-4B2E-A254-CDA12BD34DBB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.47:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"073A0AFF-C5C6-422E-BD63-2353AA4B58E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.48:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"59B5DA29-4139-405D-8AA8-23FAECBBC5CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.49:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"73F4D15D-6D2A-4730-B7CF-21284E92FEFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.50:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79A0C6AB-813F-4417-A98E-33FBB7AAB939\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.51:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"815ABF0E-ED94-4426-8889-D3C2AECACC26\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.52:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"894612F1-8C51-4F66-AFE7-D8077F63E562\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.53:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"63FD3D1E-08F8-4C7F-876C-47E88386B83E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.54:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C068E27-A3DD-4FD2-81FB-2CFEC3C047CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.55:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E21A12E6-0802-4BDC-AF71-50D7D0433B87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.56:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC7EE44A-7D8B-41A5-82A6-04AEE50278CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.57:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6862529A-1AE5-4E2D-A4B0-E351D1900C64\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.58:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4C6B6711-0F75-4FEA-8917-04391FC9D378\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.59:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6AC0249C-3CFC-4CD3-9481-9F6BE1FC5E31\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.60:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3BE639D9-0B1E-4DFB-B275-D11665FDA4AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.61:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B35E9C41-0F2A-4790-B996-8EC00FA863F1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.62:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"28BAB268-3A70-4422-9C6C-49E6453D750D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.63:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A5960F1-DDA9-4885-952F-450EC00B5C9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.64:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E725D449-BBC2-40E3-BF53-D9BF7B4F57D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.65:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B10975CB-56EB-44D0-BDEF-60484B6BD85E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.66:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3EE56C0F-0AF4-45CF-ACA2-0E583BBB3187\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.67:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"16A4A1AC-ED08-4EFE-A826-1BB1B5CAB34E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.68:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF9D7AD6-6BDB-4519-B9F8-3181E21850FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.69:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B061FF9A-0D00-429D-9B2F-14EEA41E7A33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.70:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D6CB0260-2A96-41A8-81A0-8E9722B22D87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.71:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE037065-9E33-4A5A-8188-1F086D7BE394\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.72:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"70200031-5902-416D-A140-DC2CDFDAF683\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.73:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"575C5F15-2C16-4B39-A718-1641DDD88F84\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.74:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E7BFD7E-9B3F-4D63-BEBC-16F22DA6F8E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.75:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"42631437-772B-45E0-A1F3-5D9E2FC77D19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.76:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA9E62EF-E21F-421F-9A57-54A551CEC441\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.77:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"871E046E-013A-4E10-9457-4D1F407519EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.78:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B5E4B06F-AD55-4D61-B966-B38B854C0A75\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.79:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"19817731-42C2-4745-88F2-D27258FC7DB1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.80:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"77479EEE-F81B-4653-8FAD-0AFBA3C71B09\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.81:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0208619E-9179-46D9-8E47-6CB5B4046DF9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.82:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6FBAE2A2-B7CB-45F6-A84C-5B9B742A0B56\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.83:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CC16904-03FC-42B2-89F0-CA0D59A5FB91\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.84:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4E3980D1-54F1-4C2F-B140-B2F18D8958A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.85:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C845718-520A-42CB-9BA7-00723694A01F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.86:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FAB7BF51-DD1A-41E1-B5E5-02A6BADC30DE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.87:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"431DA557-0977-43C2-8DEF-127B1BAA9F46\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.88:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"733C0A5D-3A0A-4449-9DE0-BD06D4942799\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.89:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9E5DAD5-465A-4A53-856A-1F674723EB00\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.90:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B3FE37F4-C8E6-42CC-A799-563637F6B85A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.91:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"72F9DD05-E521-45D3-994E-0400DA0070BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.92:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B5DA733E-A2BB-4F72-BE9A-AF1ADD1881A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ntp:ntp:4.3.93:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"816E4E2B-7E33-49A0-85E1-EF1755F6BB45\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.\"}, {\"lang\": \"es\", \"value\": \"Desbordamiento de b\\u00fafer basado en pila en la funci\\u00f3n reslist en ntpq en NTP en versiones anteriores a 4.2.8p10 y 4.3.x en versiones anteriores a 4.3.94 permite a servidores remotos tener un impacto no especificado a trav\\u00e9s de una variable flagstr larga en una respuesta de lista de restricciones.\"}]",
"id": "CVE-2017-6460",
"lastModified": "2024-11-21T03:29:48.803",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": true, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2017-03-27T17:59:00.697",
"references": "[{\"url\": \"http://support.ntp.org/bin/view/Main/NtpBug3377\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/97052\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1038123\", \"source\": \"cve@mitre.org\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://security.paloaltonetworks.com/CVE-2017-6460\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://support.apple.com/HT208144\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://support.ntp.org/bin/view/Main/NtpBug3377\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/97052\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securitytracker.com/id/1038123\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://security.paloaltonetworks.com/CVE-2017-6460\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://support.apple.com/HT208144\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-119\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2017-6460\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2017-03-27T17:59:00.697\",\"lastModified\":\"2025-04-20T01:37:25.860\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.\"},{\"lang\":\"es\",\"value\":\"Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n reslist en ntpq en NTP en versiones anteriores a 4.2.8p10 y 4.3.x en versiones anteriores a 4.3.94 permite a servidores remotos tener un impacto no especificado a trav\u00e9s de una variable flagstr larga en una respuesta de lista de restricciones.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":true,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-119\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"EE002C76-406D-4F22-B738-E17BDEA70BCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C1CCF6F-74C6-42D7-B88B-36ED73BB1F8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B23D9009-DF45-44C1-80DF-CEEC9B9E3F20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"43921601-667E-4415-83BE-E5B39D969BD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75DD9C02-0C46-4785-8D77-C5465E4ED967\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A497BADE-0516-494F-89FA-EAFC6AD17F7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4298439A-EAF2-4CAA-990B-4AA37E7A0E8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"30E9C822-C04A-4908-9596-76F9FB561206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"12EBD400-8EC1-4F9C-B600-85B8FF3BDEA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BE6CFF4C-2620-4FD6-91A2-C0D0DAA4287D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"842963D1-C78C-48B5-A8D2-BC018854E5CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"121ED6C5-8985-4DEF-9040-2AC63582E596\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"566B4B99-8B4F-4ED8-B2DC-D90EC71ECB99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68499DA4-64EF-412F-A434-8E0F78D77CE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"836C5AC9-463F-4703-81B9-7B5484F47A5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FED14811-8F49-4796-BADD-DB7973EC32DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D4EB2830-ADE5-4C87-964E-16748BF88EF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C0284FD-2933-4160-80D2-53B32CD73287\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9AB963A-7284-433F-9890-5AE402E4E000\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EEDEFF7A-D964-4D9A-93BF-41E9D16EA793\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C434153-911C-4F07-ADD0-0EAB47F96E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8183B043-8B96-4A8B-A5C9-544D4F1CED8D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DE349AB-44CB-4263-80CE-59DFD572B363\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3DB55DF6-567F-4B6A-81E1-9013914416D9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.23:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80727B0B-AB5E-46CC-9DDF-F319C2D9B242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.24:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0755962-2D5F-41E6-9BDB-C2ECBCCD2818\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.25:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2EBAADB5-FA32-4CF9-A4B2-51EEA300B0EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.26:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A202FDAD-D757-4850-9D1E-C31B0F3BA718\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.27:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6A345D7-DFC0-4E0D-AAAB-8206C35F63D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.28:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4069EF5-DC7D-4487-8636-AC2EAB17BAC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.29:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73DF3A5C-F1D9-468E-BD08-5E2578898DEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0858AE44-4B0A-4941-B4A8-937B557D1448\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"979C84FF-CB21-4819-B3CA-1A55FDF20BD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94709B39-C394-4B44-A362-9429F4CB9D50\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E4526AC-6BCC-43A5-B501-263D0ED0655B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.34:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E04FF6B4-CD1C-4AC1-B286-D6AB705D680B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.35:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FAFA0C8-1349-43A4-BDAC-3B5A601B9FDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.36:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BA130B1-DD20-4E98-963F-61E85A09E29E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.37:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9AAC9B73-5020-47C9-803E-ABB6162AADE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.38:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2A6B7B5-3AC9-4442-BD91-3783C2B4235C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D72F5C09-520B-486C-AD9A-9CBBFE6487CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"097DED37-D3F3-45C4-B131-1C4294406722\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.41:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"85A4F607-0A9D-4F84-B50D-28C54E6EDC06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.42:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C689CAF-632A-4FF2-8C86-541EEDD574E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.43:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B0ACF5B-BBA9-4B6C-B19D-B8AEF7212781\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.44:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E09C8254-73DC-4AFA-A250-A8192DC917F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.45:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D344FA12-3C5F-418B-9209-EA8BDD230074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.46:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1C3A62A-C6F6-4B2E-A254-CDA12BD34DBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.47:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"073A0AFF-C5C6-422E-BD63-2353AA4B58E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.48:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59B5DA29-4139-405D-8AA8-23FAECBBC5CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.49:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73F4D15D-6D2A-4730-B7CF-21284E92FEFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.50:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79A0C6AB-813F-4417-A98E-33FBB7AAB939\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.51:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"815ABF0E-ED94-4426-8889-D3C2AECACC26\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.52:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"894612F1-8C51-4F66-AFE7-D8077F63E562\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.53:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"63FD3D1E-08F8-4C7F-876C-47E88386B83E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.54:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C068E27-A3DD-4FD2-81FB-2CFEC3C047CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.55:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E21A12E6-0802-4BDC-AF71-50D7D0433B87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC7EE44A-7D8B-41A5-82A6-04AEE50278CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6862529A-1AE5-4E2D-A4B0-E351D1900C64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C6B6711-0F75-4FEA-8917-04391FC9D378\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AC0249C-3CFC-4CD3-9481-9F6BE1FC5E31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.60:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BE639D9-0B1E-4DFB-B275-D11665FDA4AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.61:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B35E9C41-0F2A-4790-B996-8EC00FA863F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.62:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28BAB268-3A70-4422-9C6C-49E6453D750D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.63:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A5960F1-DDA9-4885-952F-450EC00B5C9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.64:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E725D449-BBC2-40E3-BF53-D9BF7B4F57D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.65:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B10975CB-56EB-44D0-BDEF-60484B6BD85E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.66:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EE56C0F-0AF4-45CF-ACA2-0E583BBB3187\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.67:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"16A4A1AC-ED08-4EFE-A826-1BB1B5CAB34E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.68:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF9D7AD6-6BDB-4519-B9F8-3181E21850FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.69:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B061FF9A-0D00-429D-9B2F-14EEA41E7A33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.70:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6CB0260-2A96-41A8-81A0-8E9722B22D87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.71:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE037065-9E33-4A5A-8188-1F086D7BE394\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.72:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"70200031-5902-416D-A140-DC2CDFDAF683\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.73:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"575C5F15-2C16-4B39-A718-1641DDD88F84\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.74:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E7BFD7E-9B3F-4D63-BEBC-16F22DA6F8E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.75:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"42631437-772B-45E0-A1F3-5D9E2FC77D19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.76:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA9E62EF-E21F-421F-9A57-54A551CEC441\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.77:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"871E046E-013A-4E10-9457-4D1F407519EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.78:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5E4B06F-AD55-4D61-B966-B38B854C0A75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.79:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"19817731-42C2-4745-88F2-D27258FC7DB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.80:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"77479EEE-F81B-4653-8FAD-0AFBA3C71B09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.81:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0208619E-9179-46D9-8E47-6CB5B4046DF9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.82:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FBAE2A2-B7CB-45F6-A84C-5B9B742A0B56\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.83:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CC16904-03FC-42B2-89F0-CA0D59A5FB91\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.84:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E3980D1-54F1-4C2F-B140-B2F18D8958A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.85:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C845718-520A-42CB-9BA7-00723694A01F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.86:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FAB7BF51-DD1A-41E1-B5E5-02A6BADC30DE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.87:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"431DA557-0977-43C2-8DEF-127B1BAA9F46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.88:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"733C0A5D-3A0A-4449-9DE0-BD06D4942799\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.89:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9E5DAD5-465A-4A53-856A-1F674723EB00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.90:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3FE37F4-C8E6-42CC-A799-563637F6B85A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.91:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72F9DD05-E521-45D3-994E-0400DA0070BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.92:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5DA733E-A2BB-4F72-BE9A-AF1ADD1881A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ntp:ntp:4.3.93:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"816E4E2B-7E33-49A0-85E1-EF1755F6BB45\"}]}]}],\"references\":[{\"url\":\"http://support.ntp.org/bin/view/Main/NtpBug3377\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/97052\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1038123\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://security.paloaltonetworks.com/CVE-2017-6460\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.apple.com/HT208144\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.ntp.org/bin/view/Main/NtpBug3377\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/97052\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1038123\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://security.paloaltonetworks.com/CVE-2017-6460\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.apple.com/HT208144\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
GHSA-8C4C-PJC2-QR4R
Vulnerability from github – Published: 2022-05-17 00:31 – Updated: 2022-05-17 00:31Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.
{
"affected": [],
"aliases": [
"CVE-2017-6460"
],
"database_specific": {
"cwe_ids": [
"CWE-119"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-27T17:59:00Z",
"severity": "HIGH"
},
"details": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"id": "GHSA-8c4c-pjc2-qr4r",
"modified": "2022-05-17T00:31:37Z",
"published": "2022-05-17T00:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6460"
},
{
"type": "WEB",
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208144"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"type": "WEB",
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"type": "WEB",
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97052"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038123"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
OPENSUSE-SU-2024:11102-1
Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2024-06-15 00:00Notes
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "ntp-4.2.8p15-7.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the ntp-4.2.8p15-7.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-11102",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11102-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9042 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9042/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6451 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6451/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6458 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6458/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6460 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6460/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6462 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6462/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6463 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6463/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6464 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6464/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-12327 page",
"url": "https://www.suse.com/security/cve/CVE-2018-12327/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7170 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7170/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7182 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7182/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7183 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7183/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7184 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7184/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-7185 page",
"url": "https://www.suse.com/security/cve/CVE-2018-7185/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-8956 page",
"url": "https://www.suse.com/security/cve/CVE-2018-8956/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-8936 page",
"url": "https://www.suse.com/security/cve/CVE-2019-8936/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-11868 page",
"url": "https://www.suse.com/security/cve/CVE-2020-11868/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-13817 page",
"url": "https://www.suse.com/security/cve/CVE-2020-13817/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-15025 page",
"url": "https://www.suse.com/security/cve/CVE-2020-15025/"
}
],
"title": "ntp-4.2.8p15-7.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:11102-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p15-7.2.aarch64",
"product": {
"name": "ntp-4.2.8p15-7.2.aarch64",
"product_id": "ntp-4.2.8p15-7.2.aarch64"
}
},
{
"category": "product_version",
"name": "ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"product": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"product_id": "ntp-dcf77-tools-4.2.8p15-7.2.aarch64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p15-7.2.aarch64",
"product": {
"name": "ntp-doc-4.2.8p15-7.2.aarch64",
"product_id": "ntp-doc-4.2.8p15-7.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p15-7.2.ppc64le",
"product": {
"name": "ntp-4.2.8p15-7.2.ppc64le",
"product_id": "ntp-4.2.8p15-7.2.ppc64le"
}
},
{
"category": "product_version",
"name": "ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"product": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"product_id": "ntp-dcf77-tools-4.2.8p15-7.2.ppc64le"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p15-7.2.ppc64le",
"product": {
"name": "ntp-doc-4.2.8p15-7.2.ppc64le",
"product_id": "ntp-doc-4.2.8p15-7.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p15-7.2.s390x",
"product": {
"name": "ntp-4.2.8p15-7.2.s390x",
"product_id": "ntp-4.2.8p15-7.2.s390x"
}
},
{
"category": "product_version",
"name": "ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"product": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"product_id": "ntp-dcf77-tools-4.2.8p15-7.2.s390x"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p15-7.2.s390x",
"product": {
"name": "ntp-doc-4.2.8p15-7.2.s390x",
"product_id": "ntp-doc-4.2.8p15-7.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p15-7.2.x86_64",
"product": {
"name": "ntp-4.2.8p15-7.2.x86_64",
"product_id": "ntp-4.2.8p15-7.2.x86_64"
}
},
{
"category": "product_version",
"name": "ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"product": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"product_id": "ntp-dcf77-tools-4.2.8p15-7.2.x86_64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p15-7.2.x86_64",
"product": {
"name": "ntp-doc-4.2.8p15-7.2.x86_64",
"product_id": "ntp-doc-4.2.8p15-7.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p15-7.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64"
},
"product_reference": "ntp-4.2.8p15-7.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p15-7.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le"
},
"product_reference": "ntp-4.2.8p15-7.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p15-7.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x"
},
"product_reference": "ntp-4.2.8p15-7.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p15-7.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64"
},
"product_reference": "ntp-4.2.8p15-7.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64"
},
"product_reference": "ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le"
},
"product_reference": "ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x"
},
"product_reference": "ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-dcf77-tools-4.2.8p15-7.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64"
},
"product_reference": "ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p15-7.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64"
},
"product_reference": "ntp-doc-4.2.8p15-7.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p15-7.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p15-7.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p15-7.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x"
},
"product_reference": "ntp-doc-4.2.8p15-7.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p15-7.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
},
"product_reference": "ntp-doc-4.2.8p15-7.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9042",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9042"
}
],
"notes": [
{
"category": "general",
"text": "An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9042",
"url": "https://www.suse.com/security/cve/CVE-2016-9042"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2016-9042"
},
{
"cve": "CVE-2017-6451",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6451"
}
],
"notes": [
{
"category": "general",
"text": "The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6451",
"url": "https://www.suse.com/security/cve/CVE-2017-6451"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6451",
"url": "https://bugzilla.suse.com/1030050"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-6451"
},
{
"cve": "CVE-2017-6458",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6458"
}
],
"notes": [
{
"category": "general",
"text": "Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6458",
"url": "https://www.suse.com/security/cve/CVE-2017-6458"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-6458"
},
{
"cve": "CVE-2017-6460",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6460"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6460",
"url": "https://www.suse.com/security/cve/CVE-2017-6460"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-6460"
},
{
"cve": "CVE-2017-6462",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6462"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6462",
"url": "https://www.suse.com/security/cve/CVE-2017-6462"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-6462"
},
{
"cve": "CVE-2017-6463",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6463"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6463",
"url": "https://www.suse.com/security/cve/CVE-2017-6463"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-6463"
},
{
"cve": "CVE-2017-6464",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6464"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6464",
"url": "https://www.suse.com/security/cve/CVE-2017-6464"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2017-6464"
},
{
"cve": "CVE-2018-12327",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-12327"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-12327",
"url": "https://www.suse.com/security/cve/CVE-2018-12327"
},
{
"category": "external",
"summary": "SUSE Bug 1098531 for CVE-2018-12327",
"url": "https://bugzilla.suse.com/1098531"
},
{
"category": "external",
"summary": "SUSE Bug 1107887 for CVE-2018-12327",
"url": "https://bugzilla.suse.com/1107887"
},
{
"category": "external",
"summary": "SUSE Bug 1111552 for CVE-2018-12327",
"url": "https://bugzilla.suse.com/1111552"
},
{
"category": "external",
"summary": "SUSE Bug 1111853 for CVE-2018-12327",
"url": "https://bugzilla.suse.com/1111853"
},
{
"category": "external",
"summary": "SUSE Bug 1155513 for CVE-2018-12327",
"url": "https://bugzilla.suse.com/1155513"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-12327"
},
{
"cve": "CVE-2018-7170",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7170"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in ntp 4.2.x before 4.2.8p7 and 4.3.x before 4.3.92 allows authenticated users that know the private symmetric key to create arbitrarily-many ephemeral associations in order to win the clock selection of ntpd and modify a victim\u0027s clock via a Sybil attack. This issue exists because of an incomplete fix for CVE-2016-1549.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7170",
"url": "https://www.suse.com/security/cve/CVE-2018-7170"
},
{
"category": "external",
"summary": "SUSE Bug 1082210 for CVE-2018-7170",
"url": "https://bugzilla.suse.com/1082210"
},
{
"category": "external",
"summary": "SUSE Bug 1083424 for CVE-2018-7170",
"url": "https://bugzilla.suse.com/1083424"
},
{
"category": "external",
"summary": "SUSE Bug 1087324 for CVE-2018-7170",
"url": "https://bugzilla.suse.com/1087324"
},
{
"category": "external",
"summary": "SUSE Bug 1098531 for CVE-2018-7170",
"url": "https://bugzilla.suse.com/1098531"
},
{
"category": "external",
"summary": "SUSE Bug 1155513 for CVE-2018-7170",
"url": "https://bugzilla.suse.com/1155513"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-7170"
},
{
"cve": "CVE-2018-7182",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7182"
}
],
"notes": [
{
"category": "general",
"text": "The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7182",
"url": "https://www.suse.com/security/cve/CVE-2018-7182"
},
{
"category": "external",
"summary": "SUSE Bug 1082210 for CVE-2018-7182",
"url": "https://bugzilla.suse.com/1082210"
},
{
"category": "external",
"summary": "SUSE Bug 1083426 for CVE-2018-7182",
"url": "https://bugzilla.suse.com/1083426"
},
{
"category": "external",
"summary": "SUSE Bug 1087324 for CVE-2018-7182",
"url": "https://bugzilla.suse.com/1087324"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-7182"
},
{
"cve": "CVE-2018-7183",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7183"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7183",
"url": "https://www.suse.com/security/cve/CVE-2018-7183"
},
{
"category": "external",
"summary": "SUSE Bug 1082210 for CVE-2018-7183",
"url": "https://bugzilla.suse.com/1082210"
},
{
"category": "external",
"summary": "SUSE Bug 1083417 for CVE-2018-7183",
"url": "https://bugzilla.suse.com/1083417"
},
{
"category": "external",
"summary": "SUSE Bug 1087324 for CVE-2018-7183",
"url": "https://bugzilla.suse.com/1087324"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2018-7183"
},
{
"cve": "CVE-2018-7184",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7184"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the \"received\" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7184",
"url": "https://www.suse.com/security/cve/CVE-2018-7184"
},
{
"category": "external",
"summary": "SUSE Bug 1082210 for CVE-2018-7184",
"url": "https://bugzilla.suse.com/1082210"
},
{
"category": "external",
"summary": "SUSE Bug 1083422 for CVE-2018-7184",
"url": "https://bugzilla.suse.com/1083422"
},
{
"category": "external",
"summary": "SUSE Bug 1087324 for CVE-2018-7184",
"url": "https://bugzilla.suse.com/1087324"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-7184"
},
{
"cve": "CVE-2018-7185",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-7185"
}
],
"notes": [
{
"category": "general",
"text": "The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the \"other side\" of an interleaved association causing the victim ntpd to reset its association.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-7185",
"url": "https://www.suse.com/security/cve/CVE-2018-7185"
},
{
"category": "external",
"summary": "SUSE Bug 1082210 for CVE-2018-7185",
"url": "https://bugzilla.suse.com/1082210"
},
{
"category": "external",
"summary": "SUSE Bug 1083420 for CVE-2018-7185",
"url": "https://bugzilla.suse.com/1083420"
},
{
"category": "external",
"summary": "SUSE Bug 1087324 for CVE-2018-7185",
"url": "https://bugzilla.suse.com/1087324"
},
{
"category": "external",
"summary": "SUSE Bug 1089405 for CVE-2018-7185",
"url": "https://bugzilla.suse.com/1089405"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-7185"
},
{
"cve": "CVE-2018-8956",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-8956"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker\u0027s behalf and send them to the attacker.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-8956",
"url": "https://www.suse.com/security/cve/CVE-2018-8956"
},
{
"category": "external",
"summary": "SUSE Bug 1171355 for CVE-2018-8956",
"url": "https://bugzilla.suse.com/1171355"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2018-8956"
},
{
"cve": "CVE-2019-8936",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-8936"
}
],
"notes": [
{
"category": "general",
"text": "NTP through 4.2.8p12 has a NULL Pointer Dereference.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-8936",
"url": "https://www.suse.com/security/cve/CVE-2019-8936"
},
{
"category": "external",
"summary": "SUSE Bug 1128525 for CVE-2019-8936",
"url": "https://bugzilla.suse.com/1128525"
},
{
"category": "external",
"summary": "SUSE Bug 1148892 for CVE-2019-8936",
"url": "https://bugzilla.suse.com/1148892"
},
{
"category": "external",
"summary": "SUSE Bug 1155513 for CVE-2019-8936",
"url": "https://bugzilla.suse.com/1155513"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-8936"
},
{
"cve": "CVE-2020-11868",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-11868"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-11868",
"url": "https://www.suse.com/security/cve/CVE-2020-11868"
},
{
"category": "external",
"summary": "SUSE Bug 1169740 for CVE-2020-11868",
"url": "https://bugzilla.suse.com/1169740"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "low"
}
],
"title": "CVE-2020-11868"
},
{
"cve": "CVE-2020-13817",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-13817"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim\u0027s ntpd instance.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-13817",
"url": "https://www.suse.com/security/cve/CVE-2020-13817"
},
{
"category": "external",
"summary": "SUSE Bug 1172651 for CVE-2020-13817",
"url": "https://bugzilla.suse.com/1172651"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-13817"
},
{
"cve": "CVE-2020-15025",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-15025"
}
],
"notes": [
{
"category": "general",
"text": "ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-15025",
"url": "https://www.suse.com/security/cve/CVE-2020-15025"
},
{
"category": "external",
"summary": "SUSE Bug 1173334 for CVE-2020-15025",
"url": "https://bugzilla.suse.com/1173334"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-dcf77-tools-4.2.8p15-7.2.x86_64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.aarch64",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.ppc64le",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.s390x",
"openSUSE Tumbleweed:ntp-doc-4.2.8p15-7.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2020-15025"
}
]
}
CVE-2017-6460
Vulnerability from csaf_aumariestergmbhcokg - Published: 2022-08-09 08:00 - Updated: 2022-08-09 08:00Notes
{
"document": {
"acknowledgments": [
{
"organization": "CERT@VDE",
"summary": "coordination",
"urls": [
"https://certvde.com"
]
}
],
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-GB",
"notes": [
{
"category": "summary",
"text": "The SIMA2 Master Station features an NTP service based on ntpd, a reference implementation of the Network Time Protocol (NTP). Affected SIMA2 Master Stations with software version \u003c V2.6 include an outdated version of ntpd which is affected by a large number of vulnerabilities",
"title": "Summary"
},
{
"category": "description",
"text": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"title": "Mitigation"
},
{
"category": "description",
"text": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"title": "Remediation"
}
],
"publisher": {
"category": "vendor",
"contact_details": "psirt@auma.com",
"name": "AUMA Riester GmbH \u0026 Co. KG",
"namespace": "https://auma.com"
},
"references": [
{
"category": "self",
"summary": "VDE-2022-032: AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service - HTML",
"url": "https://certvde.com/en/advisories/VDE-2022-032/"
},
{
"category": "self",
"summary": "VDE-2022-032: AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service - CSAF",
"url": "https://auma.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-032.json"
},
{
"category": "external",
"summary": "AUMA PSIRT",
"url": "https://www.auma.com/en_GB/service/psirt"
},
{
"category": "external",
"summary": "CERT@VDE Security Advisories for AUMA Riester GmbH \u0026 Co. KG",
"url": "https://certvde.com/en/advisories/vendor/auma/"
}
],
"title": "AUMA: Multiple Vulnerabilities in Automation Runtime NTP Service",
"tracking": {
"aliases": [
"VDE-2022-032"
],
"current_release_date": "2022-08-09T08:00:00.000Z",
"generator": {
"date": "2025-05-05T07:36:58.640Z",
"engine": {
"name": "Secvisogram",
"version": "2.5.24"
}
},
"id": "VDE-2022-032",
"initial_release_date": "2022-08-09T08:00:00.000Z",
"revision_history": [
{
"date": "2022-08-09T08:00:00.000Z",
"number": "1",
"summary": "Initial revision."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003cV2.6",
"product": {
"name": "SIMA\u00b2 Master Station \u003c V2.6",
"product_id": "CSAFPID-51001"
}
},
{
"category": "product_version",
"name": "V2.6",
"product": {
"name": "SIMA\u00b2 Master Station V2.6",
"product_id": "CSAFPID-52001"
}
}
],
"category": "product_name",
"name": "SIMA\u00b2 Master Station"
}
],
"category": "product_family",
"name": "Software"
}
],
"category": "vendor",
"name": "AUMA"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2009-3563",
"notes": [
{
"category": "description",
"text": "ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"environmentalScore": 6.4,
"integrityImpact": "PARTIAL",
"temporalScore": 6.4,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2009-3563"
},
{
"cve": "CVE-2013-5211",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5,
"confidentialityImpact": "NONE",
"environmentalScore": 5,
"integrityImpact": "NONE",
"temporalScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2013-5211"
},
{
"cve": "CVE-2014-9293",
"notes": [
{
"category": "description",
"text": "The config_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"environmentalScore": 7.5,
"integrityImpact": "PARTIAL",
"temporalScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2014-9293"
},
{
"cve": "CVE-2014-9294",
"notes": [
{
"category": "description",
"text": "util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"environmentalScore": 7.5,
"integrityImpact": "PARTIAL",
"temporalScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2014-9294"
},
{
"cve": "CVE-2014-9295",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, related to (1) the crypto_recv function when the Autokey Authentication feature is used, (2) the ctl_putdata function, and (3) the configure function.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"environmentalScore": 7.5,
"integrityImpact": "PARTIAL",
"temporalScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2014-9295"
},
{
"cve": "CVE-2014-9296",
"notes": [
{
"category": "description",
"text": "The receive function in ntp_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which might allow remote attackers to trigger an unintended association change via crafted packets.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5,
"confidentialityImpact": "NONE",
"environmentalScore": 5,
"integrityImpact": "NONE",
"temporalScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2014-9296"
},
{
"cve": "CVE-2014-9750",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "ntp_crypto.c in ntpd in NTP 4.x before 4.2.8p1, when Autokey Authentication is enabled, allows remote attackers to obtain sensitive information from process memory or cause a denial of service (daemon crash) via a packet containing an extension field with an invalid value for the length of its value field.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"environmentalScore": 5.8,
"integrityImpact": "NONE",
"temporalScore": 5.8,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
"version": "2.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2014-9750"
},
{
"cve": "CVE-2015-7691",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7691"
},
{
"cve": "CVE-2015-7692",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7692"
},
{
"cve": "CVE-2015-7702",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7702"
},
{
"cve": "CVE-2015-7704",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted \"KOD\" messages.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7704"
},
{
"cve": "CVE-2015-7849",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "description",
"text": "Use-after-free vulnerability in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to possibly execute arbitrary code or cause a denial of service (crash) via crafted packets.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7849"
},
{
"cve": "CVE-2015-7850",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7850"
},
{
"cve": "CVE-2015-7851",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "description",
"text": "Directory traversal vulnerability in the save_config function in ntpd in ntp_control.c in NTP before 4.2.8p4, when used on systems that do not use \u0027\\\u0027 or \u0027/\u0027 characters for directory separation such as OpenVMS, allows remote authenticated users to overwrite arbitrary files.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7851"
},
{
"cve": "CVE-2015-7852",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7852"
},
{
"cve": "CVE-2015-7854",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "description",
"text": "Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted key file.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7854"
},
{
"cve": "CVE-2015-7855",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7855"
},
{
"cve": "CVE-2015-7871",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "description",
"text": "Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7871"
},
{
"cve": "CVE-2015-7973",
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p6 and 4.3.x before 4.3.90, when configured in broadcast mode, allows man-in-the-middle attackers to conduct replay attacks by sniffing the network.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7973"
},
{
"cve": "CVE-2015-7974",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "description",
"text": "NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a \"skeleton key.\"",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.7,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7974"
},
{
"cve": "CVE-2015-7975",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "The nextvar function in NTP before 4.2.8p6 and 4.3.x before 4.3.90 does not properly validate the length of its input, which allows an attacker to cause a denial of service (application crash).",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.2,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 6.2,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7975"
},
{
"cve": "CVE-2015-7976",
"notes": [
{
"category": "description",
"text": "The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause unspecified impact via a crafted filename.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7976"
},
{
"cve": "CVE-2015-7977",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7977"
},
{
"cve": "CVE-2015-7978",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7978"
},
{
"cve": "CVE-2015-7979",
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (client-server association tear down) by sending broadcast packets with invalid authentication to a broadcast client.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7979"
},
{
"cve": "CVE-2015-8138",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to bypass the origin timestamp validation via a packet with an origin timestamp set to zero.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-8138"
},
{
"cve": "CVE-2015-8139",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "description",
"text": "ntpq in NTP before 4.2.8p7 allows remote attackers to obtain origin timestamps and then impersonate peers via unspecified vectors.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-8139"
},
{
"cve": "CVE-2015-8140",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"notes": [
{
"category": "description",
"text": "The ntpq protocol in NTP before 4.2.8p7 allows remote attackers to conduct replay attacks by sniffing the network.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.8,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 4.8,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-8140"
},
{
"cve": "CVE-2015-8158",
"notes": [
{
"category": "description",
"text": "The getresponse function in ntpq in NTP versions before 4.2.8p9 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (infinite loop) via crafted packets with incorrect values.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-8158"
},
{
"cve": "CVE-2016-1547",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-1547"
},
{
"cve": "CVE-2016-1550",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"notes": [
{
"category": "description",
"text": "An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. An attacker can send a series of crafted messages to attempt to recover the message digest key.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-1550"
},
{
"cve": "CVE-2016-2517",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (prevent subsequent authentication) by leveraging knowledge of the controlkey or requestkey and sending a crafted packet to ntpd, which changes the value of trustedkey, controlkey, or requestkey. NOTE: this vulnerability exists because of a CVE-2016-2516 regression.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-2517"
},
{
"cve": "CVE-2016-2518",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-2518"
},
{
"cve": "CVE-2016-4953",
"cwe": {
"id": "CWE-287",
"name": "Improper Authentication"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK packet with incorrect authentication data at a certain time.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-4953"
},
{
"cve": "CVE-2016-4954",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "description",
"text": "The process_packet function in ntp_proto.c in ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (peer-variable modification) by sending spoofed packets from many source IP addresses in a certain scenario, as demonstrated by triggering an incorrect leap indication.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-4954"
},
{
"cve": "CVE-2016-4955",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP 4.x before 4.2.8p8, when autokey is enabled, allows remote attackers to cause a denial of service (peer-variable clearing and association outage) by sending (1) a spoofed crypto-NAK packet or (2) a packet with an incorrect MAC value at a certain time.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-4955"
},
{
"cve": "CVE-2016-7427",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via a crafted broadcast mode packet.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7427"
},
{
"cve": "CVE-2016-7431",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. NOTE: this vulnerability exists because of a CVE-2015-8138 regression.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7431"
},
{
"cve": "CVE-2016-7433",
"cwe": {
"id": "CWE-682",
"name": "Incorrect Calculation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown vectors, related to a \"root distance that did not include the peer dispersion.\"",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7433"
},
{
"cve": "CVE-2016-7434",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7434"
},
{
"cve": "CVE-2016-9310",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mode packet.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-9310"
},
{
"cve": "CVE-2016-9311",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted packet.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-9311"
},
{
"cve": "CVE-2017-6451",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2017-6451"
},
{
"cve": "CVE-2017-6458",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2017-6458"
},
{
"cve": "CVE-2017-6460",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 8.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 8.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2017-6460"
},
{
"cve": "CVE-2017-6462",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalScore": 7.8,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 7.8,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2017-6462"
},
{
"cve": "CVE-2017-6463",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2017-6463"
},
{
"cve": "CVE-2017-6464",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2017-6464"
},
{
"cve": "CVE-2018-12327",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter. NOTE: It is unclear whether there are any common situations in which ntpq or ntpdc is used with a command line from an untrusted source.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2018-12327"
},
{
"cve": "CVE-2018-7182",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "description",
"text": "The ctl_getitem method in ntpd in ntp-4.2.8p6 before 4.2.8p11 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted mode 6 packet with a ntpd instance from 4.2.8p6 through 4.2.8p10.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2018-7182"
},
{
"cve": "CVE-2018-7183",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "description",
"text": "Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute arbitrary code by leveraging an ntpq query and sending a response with a crafted array.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2018-7183"
},
{
"cve": "CVE-2018-7184",
"notes": [
{
"category": "description",
"text": "ntpd in ntp 4.2.8p4 before 4.2.8p11 drops bad packets before updating the \"received\" timestamp, which allows remote attackers to cause a denial of service (disruption) by sending a packet with a zero-origin timestamp causing the association to reset and setting the contents of the packet as the most recent timestamp. This issue is a result of an incomplete fix for CVE-2015-7704.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2018-7184"
},
{
"cve": "CVE-2018-7185",
"notes": [
{
"category": "description",
"text": "The protocol engine in ntp 4.2.6 before 4.2.8p11 allows a remote attackers to cause a denial of service (disruption) by continually sending a packet with a zero-origin timestamp and source IP address of the \"other side\" of an interleaved association causing the victim ntpd to reset its association.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2018-7185"
},
{
"cve": "CVE-2018-8956",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote attackers to prevent a broadcast client from synchronizing its clock with a broadcast NTP server via soofed mode 3 and mode 5 packets. The attacker must either be a part of the same broadcast network or control a slave in that broadcast network that can capture certain required packets on the attacker\u0027s behalf and send them to the attacker.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2018-8956"
},
{
"cve": "CVE-2019-8936",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "NTP through 4.2.8p12 has a NULL Pointer Dereference.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2019-8936"
},
{
"cve": "CVE-2020-11868",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"notes": [
{
"category": "description",
"text": "ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2020-11868"
},
{
"cve": "CVE-2020-13817",
"cwe": {
"id": "CWE-330",
"name": "Use of Insufficiently Random Values"
},
"notes": [
{
"category": "description",
"text": "ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows remote attackers to cause a denial of service (daemon exit or system time change) by predicting transmit timestamps for use in spoofed packets. The victim must be relying on unauthenticated IPv4 time sources. There must be an off-path attacker who can query time from the victim\u0027s ntpd instance.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.4,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.4,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2020-13817"
},
{
"cve": "CVE-2020-15025",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by sending packets, because memory is not freed in situations where a CMAC key is used and associated with a CMAC algorithm in the ntp.keys file.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"temporalScore": 4.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2020-15025"
},
{
"cve": "CVE-2015-7701",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "description",
"text": "Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7701"
},
{
"cve": "CVE-2015-5300",
"notes": [
{
"category": "description",
"text": "The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to an arbitrary time when started with the -g option, or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources, and leveraging a resulting denial of service (abort and restart).",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-5300"
},
{
"cve": "CVE-2015-7853",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "description",
"text": "The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7853"
},
{
"cve": "CVE-2015-7705",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"environmentalScore": 9.8,
"environmentalSeverity": "CRITICAL",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 9.8,
"temporalSeverity": "CRITICAL",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7705"
},
{
"cve": "CVE-2015-7703",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "The \"pidfile\" or \"driftfile\" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2015-7703"
},
{
"cve": "CVE-2016-7429",
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to cause a denial of service (prevent communication with a source) by sending a response for a source to an interface the source does not use.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"environmentalScore": 3.7,
"environmentalSeverity": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 3.7,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7429"
},
{
"cve": "CVE-2016-7428",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a broadcast packet.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 4.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 4.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7428"
},
{
"cve": "CVE-2016-7426",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial of service (prevent responses from the sources) by sending responses with a spoofed source address.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-7426"
},
{
"cve": "CVE-2016-4957",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-1547.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.5,
"environmentalSeverity": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-4957"
},
{
"cve": "CVE-2016-4956",
"notes": [
{
"category": "description",
"text": "ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packet. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-1548.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-4956"
},
{
"cve": "CVE-2016-2519",
"cwe": {
"id": "CWE-119",
"name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
},
"notes": [
{
"category": "description",
"text": "ntpd in NTP before 4.2.8p7 and 4.3.x before 4.3.92 allows remote attackers to cause a denial of service (ntpd abort) by a large request data value, which triggers the ctl_getitem function to return a NULL value.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.9,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 5.9,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-2519"
},
{
"cve": "CVE-2016-2516",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"notes": [
{
"category": "description",
"text": "NTP before 4.2.8p7 and 4.3.x before 4.3.92, when mode7 is enabled, allows remote attackers to cause a denial of service (ntpd abort) by using the same IP address multiple times in an unconfig directive.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 5.3,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 5.3,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-2516"
},
{
"cve": "CVE-2016-1551",
"notes": [
{
"category": "description",
"text": "ntpd in NTP 4.2.8p3 and NTPsec a5fb34b9cc89b92a8fef2f459004865c93bb7f92 relies on the underlying operating system to protect it from requests that impersonate reference clocks. Because reference clocks are treated like other peers and stored in the same structure, any packet with a source ip address of a reference clock (127.127.1.1 for example) that reaches the receive() function will match that reference clock\u0027s peer record and will be treated as a trusted peer. Any system that lacks the typical martian packet filtering which would block these packets is in danger of having its time controlled by an attacker.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"environmentalScore": 3.7,
"environmentalSeverity": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 3.7,
"temporalSeverity": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-1551"
},
{
"cve": "CVE-2016-1549",
"notes": [
{
"category": "description",
"text": "A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earlier and NTPsec 3e160db8dc248a0bcb053b56a80167dc742d2b74 and a5fb34b9cc89b92a8fef2f459004865c93bb7f92 and modify a victim\u0027s clock.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"environmentalScore": 6.5,
"environmentalSeverity": "MEDIUM",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"temporalScore": 6.5,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-1549"
},
{
"cve": "CVE-2016-1548",
"notes": [
{
"category": "description",
"text": "An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer-\u003edst timestamp recorded for that server. After making this switch, the client in NTP 4.2.8p4 and earlier and NTPSec aa48d001683e5b791a743ec9c575aaf7d867a2b0c will reject all future legitimate server responses. It is possible to force the victim client to move time after the mode has been changed. ntpq gives no indication that the mode has been switched.",
"title": "Vulnerability Description"
}
],
"product_status": {
"fixed": [
"CSAFPID-52001"
],
"known_affected": [
"CSAFPID-51001"
]
},
"remediations": [
{
"category": "mitigation",
"details": "1. If your SIMA2 does not need to provide time information to other systems or synchronize itself with an NTP server, disable the NTP client on those systems. Please note that the NTP client is disabled by default in SIMA2\n\n\n2. In case you must use the NTP server on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Allow NTP traffic to/from trusted NTP clients only\n\n- Monitor the network for malicious NTP traffic going to/coming from the SIMA2\n\n- Filter malicious NTP traffic going to/coming from the SIMA2 Monitor NTP server operations on your SIMA2 (server availability, correctness of advertised time, NTP-related log entries, etc.)\n\n\n3. In case you must use the NTP client on an SIMA2, choose from the following options to reduce NTP-based risks:\n\n- Use trusted NTP servers only\n\n- Allow NTP traffic to/from trusted NTP servers only\n\n- Monitor the network for malicious NTP traffic targeting the SIMA2\n\n- Filter malicious NTP traffic targeting the SIMA2\n\n- Monitor NTP client operations on your SIMA2 (correctness of system time, NTP-related log entries, etc.)",
"product_ids": [
"CSAFPID-51001"
]
},
{
"category": "vendor_fix",
"details": "Upgrade your\u00a0SIMA2 to software version 2.6 or above. The NTP service of the\u00a0SIMA2 Master Station with software version V2.6 and above includes a current, supported version of ntpd.",
"product_ids": [
"CSAFPID-51001"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalScore": 7.2,
"environmentalSeverity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"temporalScore": 7.2,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
},
"products": [
"CSAFPID-51001"
]
}
],
"title": "CVE-2016-1548"
}
]
}
SUSE-SU-2017:1048-1
Vulnerability from csaf_suse - Published: 2017-04-18 14:06 - Updated: 2017-04-18 14:06Notes
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for ntp",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis ntp update to version 4.2.8p10 fixes serveral issues.\n\nThis updated enables leap smearing. See\n/usr/share/doc/packages/ntp/README.leapsmear for details.\n\nSecurity issues fixed (bsc#1030050):\n\n- CVE-2017-6464: Denial of Service via Malformed Config\n- CVE-2017-6462: Buffer Overflow in DPTS Clock\n- CVE-2017-6463: Authenticated DoS via Malicious Config Option\n- CVE-2017-6458: Potential Overflows in ctl_put() functions\n- CVE-2017-6451: Improper use of snprintf() in mx4200_send()\n- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist\n- CVE-2016-9042: 0rigin (zero origin) DoS.\n- ntpq_stripquotes() returns incorrect Value\n- ereallocarray()/eallocarray() underused\n- Copious amounts of Unused Code\n- Off-by-one in Oncore GPS Receiver\n- Makefile does not enforce Security Flags\n\nBugfixes:\n\n- Remove spurious log messages (bsc#1014172).\n- clang scan-build findings\n- Support for openssl-1.1.0 without compatibility modes\n- Bugfix 3072 breaks multicastclient\n- forking async worker: interrupted pipe I/O\n- (...) time_pps_create: Exec format error\n- Incorrect Logic for Peer Event Limiting\n- Change the process name of forked DNS worker\n- Trap Configuration Fail\n- Nothing happens if minsane \u003c maxclock \u003c minclock\n- allow -4/-6 on restrict line with mask\n- out-of-bound pointers in ctl_putsys and decode_bitflags\n- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for\n transactional updates.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-DESKTOP-12-SP1-2017-611,SUSE-SLE-DESKTOP-12-SP2-2017-611,SUSE-SLE-RPI-12-SP2-2017-611,SUSE-SLE-SERVER-12-SP1-2017-611,SUSE-SLE-SERVER-12-SP2-2017-611",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_1048-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2017:1048-1",
"url": "https://www.suse.com/support/update/announcement/2017/suse-su-20171048-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2017:1048-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2017-April/002812.html"
},
{
"category": "self",
"summary": "SUSE Bug 1014172",
"url": "https://bugzilla.suse.com/1014172"
},
{
"category": "self",
"summary": "SUSE Bug 1030050",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9042 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9042/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6451 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6451/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6458 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6458/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6460 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6460/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6462 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6462/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6463 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6463/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6464 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6464/"
}
],
"title": "Security update for ntp",
"tracking": {
"current_release_date": "2017-04-18T14:06:01Z",
"generator": {
"date": "2017-04-18T14:06:01Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2017:1048-1",
"initial_release_date": "2017-04-18T14:06:01Z",
"revision_history": [
{
"date": "2017-04-18T14:06:01Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-60.1.aarch64",
"product": {
"name": "ntp-4.2.8p10-60.1.aarch64",
"product_id": "ntp-4.2.8p10-60.1.aarch64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-60.1.aarch64",
"product": {
"name": "ntp-doc-4.2.8p10-60.1.aarch64",
"product_id": "ntp-doc-4.2.8p10-60.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-60.1.ppc64le",
"product": {
"name": "ntp-4.2.8p10-60.1.ppc64le",
"product_id": "ntp-4.2.8p10-60.1.ppc64le"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-60.1.ppc64le",
"product": {
"name": "ntp-doc-4.2.8p10-60.1.ppc64le",
"product_id": "ntp-doc-4.2.8p10-60.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-60.1.s390x",
"product": {
"name": "ntp-4.2.8p10-60.1.s390x",
"product_id": "ntp-4.2.8p10-60.1.s390x"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-60.1.s390x",
"product": {
"name": "ntp-doc-4.2.8p10-60.1.s390x",
"product_id": "ntp-doc-4.2.8p10-60.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-60.1.x86_64",
"product": {
"name": "ntp-4.2.8p10-60.1.x86_64",
"product_id": "ntp-4.2.8p10-60.1.x86_64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-60.1.x86_64",
"product": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64",
"product_id": "ntp-doc-4.2.8p10-60.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Desktop 12 SP1",
"product_id": "SUSE Linux Enterprise Desktop 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Desktop 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Desktop 12 SP2",
"product_id": "SUSE Linux Enterprise Desktop 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sled:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
"product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp1"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:12:sp2"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12:sp2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
"product_id": "SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP1",
"product_id": "SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2",
"product_id": "SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Desktop 12 SP2",
"product_id": "SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Desktop 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
"product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64"
},
"product_reference": "ntp-4.2.8p10-60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.aarch64 as component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2",
"product_id": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for Raspberry Pi 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP1",
"product_id": "SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP1",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64"
},
"product_reference": "ntp-4.2.8p10-60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP2",
"product_id": "SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64"
},
"product_reference": "ntp-4.2.8p10-60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-60.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP2",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-60.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9042",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9042"
}
],
"notes": [
{
"category": "general",
"text": "An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9042",
"url": "https://www.suse.com/security/cve/CVE-2016-9042"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2016-9042"
},
{
"cve": "CVE-2017-6451",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6451"
}
],
"notes": [
{
"category": "general",
"text": "The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6451",
"url": "https://www.suse.com/security/cve/CVE-2017-6451"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6451",
"url": "https://bugzilla.suse.com/1030050"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2017-6451"
},
{
"cve": "CVE-2017-6458",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6458"
}
],
"notes": [
{
"category": "general",
"text": "Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6458",
"url": "https://www.suse.com/security/cve/CVE-2017-6458"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2017-6458"
},
{
"cve": "CVE-2017-6460",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6460"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6460",
"url": "https://www.suse.com/security/cve/CVE-2017-6460"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2017-6460"
},
{
"cve": "CVE-2017-6462",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6462"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6462",
"url": "https://www.suse.com/security/cve/CVE-2017-6462"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2017-6462"
},
{
"cve": "CVE-2017-6463",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6463"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6463",
"url": "https://www.suse.com/security/cve/CVE-2017-6463"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2017-6463"
},
{
"cve": "CVE-2017-6464",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6464"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6464",
"url": "https://www.suse.com/security/cve/CVE-2017-6464"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Desktop 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Desktop 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP1:ntp-doc-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-4.2.8p10-60.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.aarch64",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.ppc64le",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 12 SP2:ntp-doc-4.2.8p10-60.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:01Z",
"details": "moderate"
}
],
"title": "CVE-2017-6464"
}
]
}
SUSE-SU-2017:1052-1
Vulnerability from csaf_suse - Published: 2017-04-18 14:06 - Updated: 2017-04-18 14:06Notes
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for ntp",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis ntp update to version 4.2.8p10 fixes the following issues:\n\nSecurity issues fixed (bsc#1030050):\n- CVE-2017-6464: Denial of Service via Malformed Config\n- CVE-2017-6462: Buffer Overflow in DPTS Clock\n- CVE-2017-6463: Authenticated DoS via Malicious Config Option\n- CVE-2017-6458: Potential Overflows in ctl_put() functions\n- CVE-2017-6451: Improper use of snprintf() in mx4200_send()\n- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist\n- CVE-2016-9042: 0rigin (zero origin) DoS.\n- ntpq_stripquotes() returns incorrect Value\n- ereallocarray()/eallocarray() underused\n- Copious amounts of Unused Code\n- Off-by-one in Oncore GPS Receiver\n- Makefile does not enforce Security Flags\n\nBugfixes:\n- Remove spurious log messages (bsc#1014172).\n- Fixing ppc and ppc64 linker issue (bsc#1031085).\n- clang scan-build findings\n- Support for openssl-1.1.0 without compatibility modes\n- Bugfix 3072 breaks multicastclient\n- forking async worker: interrupted pipe I/O\n- (...) time_pps_create: Exec format error\n- Incorrect Logic for Peer Event Limiting\n- Change the process name of forked DNS worker\n- Trap Configuration Fail\n- Nothing happens if minsane \u003c maxclock \u003c minclock\n- allow -4/-6 on restrict line with mask\n- out-of-bound pointers in ctl_putsys and decode_bitflags\n- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for\n transactional updates.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "slessp4-ntp-13066",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_1052-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2017:1052-1",
"url": "https://www.suse.com/support/update/announcement/2017/suse-su-20171052-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2017:1052-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2017-April/002813.html"
},
{
"category": "self",
"summary": "SUSE Bug 1014172",
"url": "https://bugzilla.suse.com/1014172"
},
{
"category": "self",
"summary": "SUSE Bug 1030050",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "self",
"summary": "SUSE Bug 1031085",
"url": "https://bugzilla.suse.com/1031085"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9042 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9042/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6451 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6451/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6458 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6458/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6460 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6460/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6462 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6462/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6463 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6463/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6464 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6464/"
}
],
"title": "Security update for ntp",
"tracking": {
"current_release_date": "2017-04-18T14:06:55Z",
"generator": {
"date": "2017-04-18T14:06:55Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2017:1052-1",
"initial_release_date": "2017-04-18T14:06:55Z",
"revision_history": [
{
"date": "2017-04-18T14:06:55Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-63.1.i586",
"product": {
"name": "ntp-4.2.8p10-63.1.i586",
"product_id": "ntp-4.2.8p10-63.1.i586"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-63.1.i586",
"product": {
"name": "ntp-doc-4.2.8p10-63.1.i586",
"product_id": "ntp-doc-4.2.8p10-63.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-63.1.ia64",
"product": {
"name": "ntp-4.2.8p10-63.1.ia64",
"product_id": "ntp-4.2.8p10-63.1.ia64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-63.1.ia64",
"product": {
"name": "ntp-doc-4.2.8p10-63.1.ia64",
"product_id": "ntp-doc-4.2.8p10-63.1.ia64"
}
}
],
"category": "architecture",
"name": "ia64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-63.1.ppc64",
"product": {
"name": "ntp-4.2.8p10-63.1.ppc64",
"product_id": "ntp-4.2.8p10-63.1.ppc64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-63.1.ppc64",
"product": {
"name": "ntp-doc-4.2.8p10-63.1.ppc64",
"product_id": "ntp-doc-4.2.8p10-63.1.ppc64"
}
}
],
"category": "architecture",
"name": "ppc64"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-63.1.s390x",
"product": {
"name": "ntp-4.2.8p10-63.1.s390x",
"product_id": "ntp-4.2.8p10-63.1.s390x"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-63.1.s390x",
"product": {
"name": "ntp-doc-4.2.8p10-63.1.s390x",
"product_id": "ntp-doc-4.2.8p10-63.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-63.1.x86_64",
"product": {
"name": "ntp-4.2.8p10-63.1.x86_64",
"product_id": "ntp-4.2.8p10-63.1.x86_64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-63.1.x86_64",
"product": {
"name": "ntp-doc-4.2.8p10-63.1.x86_64",
"product_id": "ntp-doc-4.2.8p10-63.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_sles:11:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:11:sp4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.i586 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586"
},
"product_reference": "ntp-4.2.8p10-63.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64"
},
"product_reference": "ntp-4.2.8p10-63.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64"
},
"product_reference": "ntp-4.2.8p10-63.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.s390x as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x"
},
"product_reference": "ntp-4.2.8p10-63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.i586 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.ia64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.ppc64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.s390x as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.x86_64 as component of SUSE Linux Enterprise Server 11 SP4",
"product_id": "SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586"
},
"product_reference": "ntp-4.2.8p10-63.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64"
},
"product_reference": "ntp-4.2.8p10-63.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64"
},
"product_reference": "ntp-4.2.8p10-63.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x"
},
"product_reference": "ntp-4.2.8p10-63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-63.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.i586 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.i586",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.ia64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.ia64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.ppc64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.ppc64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-63.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 11 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-63.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 11 SP4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9042",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9042"
}
],
"notes": [
{
"category": "general",
"text": "An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9042",
"url": "https://www.suse.com/security/cve/CVE-2016-9042"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2016-9042"
},
{
"cve": "CVE-2017-6451",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6451"
}
],
"notes": [
{
"category": "general",
"text": "The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6451",
"url": "https://www.suse.com/security/cve/CVE-2017-6451"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6451",
"url": "https://bugzilla.suse.com/1030050"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2017-6451"
},
{
"cve": "CVE-2017-6458",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6458"
}
],
"notes": [
{
"category": "general",
"text": "Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6458",
"url": "https://www.suse.com/security/cve/CVE-2017-6458"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2017-6458"
},
{
"cve": "CVE-2017-6460",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6460"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6460",
"url": "https://www.suse.com/security/cve/CVE-2017-6460"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2017-6460"
},
{
"cve": "CVE-2017-6462",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6462"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6462",
"url": "https://www.suse.com/security/cve/CVE-2017-6462"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2017-6462"
},
{
"cve": "CVE-2017-6463",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6463"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6463",
"url": "https://www.suse.com/security/cve/CVE-2017-6463"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2017-6463"
},
{
"cve": "CVE-2017-6464",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6464"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6464",
"url": "https://www.suse.com/security/cve/CVE-2017-6464"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-4.2.8p10-63.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.i586",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ia64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.ppc64",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.s390x",
"SUSE Linux Enterprise Server for SAP Applications 11 SP4:ntp-doc-4.2.8p10-63.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:55Z",
"details": "moderate"
}
],
"title": "CVE-2017-6464"
}
]
}
SUSE-SU-2017:1047-1
Vulnerability from csaf_suse - Published: 2017-04-18 14:06 - Updated: 2017-04-18 14:06Notes
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for ntp",
"title": "Title of the patch"
},
{
"category": "description",
"text": "\nThis ntp update to version 4.2.8p10 fixes serveral issues.\n\nThis updated enables leap smearing. See\n/usr/share/doc/packages/ntp/README.leapsmear for details.\n\nSecurity issues fixed (bsc#1030050):\n\n- CVE-2017-6464: Denial of Service via Malformed Config\n- CVE-2017-6462: Buffer Overflow in DPTS Clock\n- CVE-2017-6463: Authenticated DoS via Malicious Config Option\n- CVE-2017-6458: Potential Overflows in ctl_put() functions\n- CVE-2017-6451: Improper use of snprintf() in mx4200_send()\n- CVE-2017-6460: Buffer Overflow in ntpq when fetching reslist\n- CVE-2016-9042: 0rigin (zero origin) DoS.\n- ntpq_stripquotes() returns incorrect Value\n- ereallocarray()/eallocarray() underused\n- Copious amounts of Unused Code\n- Off-by-one in Oncore GPS Receiver\n- Makefile does not enforce Security Flags\n\nBugfixes:\n\n- Remove spurious log messages (bsc#1014172).\n- clang scan-build findings\n- Support for openssl-1.1.0 without compatibility modes\n- Bugfix 3072 breaks multicastclient\n- forking async worker: interrupted pipe I/O\n- (...) time_pps_create: Exec format error\n- Incorrect Logic for Peer Event Limiting\n- Change the process name of forked DNS worker\n- Trap Configuration Fail\n- Nothing happens if minsane \u003c maxclock \u003c minclock\n- allow -4/-6 on restrict line with mask\n- out-of-bound pointers in ctl_putsys and decode_bitflags\n- Move ntp-kod to /var/lib/ntp, because /var/db is not a standard directory and causes problems for\n transactional updates.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-SAP-12-2017-612,SUSE-SLE-SERVER-12-2017-612",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_1047-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2017:1047-1",
"url": "https://www.suse.com/support/update/announcement/2017/suse-su-20171047-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2017:1047-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2017-April/002811.html"
},
{
"category": "self",
"summary": "SUSE Bug 1014172",
"url": "https://bugzilla.suse.com/1014172"
},
{
"category": "self",
"summary": "SUSE Bug 1030050",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-9042 page",
"url": "https://www.suse.com/security/cve/CVE-2016-9042/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6451 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6451/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6458 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6458/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6460 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6460/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6462 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6462/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6463 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6463/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-6464 page",
"url": "https://www.suse.com/security/cve/CVE-2017-6464/"
}
],
"title": "Security update for ntp",
"tracking": {
"current_release_date": "2017-04-18T14:06:17Z",
"generator": {
"date": "2017-04-18T14:06:17Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2017:1047-1",
"initial_release_date": "2017-04-18T14:06:17Z",
"revision_history": [
{
"date": "2017-04-18T14:06:17Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-46.23.1.ppc64le",
"product": {
"name": "ntp-4.2.8p10-46.23.1.ppc64le",
"product_id": "ntp-4.2.8p10-46.23.1.ppc64le"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-46.23.1.ppc64le",
"product": {
"name": "ntp-doc-4.2.8p10-46.23.1.ppc64le",
"product_id": "ntp-doc-4.2.8p10-46.23.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-46.23.1.s390x",
"product": {
"name": "ntp-4.2.8p10-46.23.1.s390x",
"product_id": "ntp-4.2.8p10-46.23.1.s390x"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-46.23.1.s390x",
"product": {
"name": "ntp-doc-4.2.8p10-46.23.1.s390x",
"product_id": "ntp-doc-4.2.8p10-46.23.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ntp-4.2.8p10-46.23.1.x86_64",
"product": {
"name": "ntp-4.2.8p10-46.23.1.x86_64",
"product_id": "ntp-4.2.8p10-46.23.1.x86_64"
}
},
{
"category": "product_version",
"name": "ntp-doc-4.2.8p10-46.23.1.x86_64",
"product": {
"name": "ntp-doc-4.2.8p10-46.23.1.x86_64",
"product_id": "ntp-doc-4.2.8p10-46.23.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 12-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-46.23.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-46.23.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-46.23.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-46.23.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-46.23.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le"
},
"product_reference": "ntp-4.2.8p10-46.23.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-46.23.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x"
},
"product_reference": "ntp-4.2.8p10-46.23.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-4.2.8p10-46.23.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64"
},
"product_reference": "ntp-4.2.8p10-46.23.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-46.23.1.ppc64le as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le"
},
"product_reference": "ntp-doc-4.2.8p10-46.23.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-46.23.1.s390x as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x"
},
"product_reference": "ntp-doc-4.2.8p10-46.23.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ntp-doc-4.2.8p10-46.23.1.x86_64 as component of SUSE Linux Enterprise Server 12-LTSS",
"product_id": "SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64"
},
"product_reference": "ntp-doc-4.2.8p10-46.23.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 12-LTSS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-9042",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-9042"
}
],
"notes": [
{
"category": "general",
"text": "An exploitable denial of service vulnerability exists in the origin timestamp check functionality of ntpd 4.2.8p9. A specially crafted unauthenticated network packet can be used to reset the expected origin timestamp for target peers. Legitimate replies from targeted peers will fail the origin timestamp check (TEST2) causing the reply to be dropped and creating a denial of service condition.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-9042",
"url": "https://www.suse.com/security/cve/CVE-2016-9042"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2016-9042",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2016-9042"
},
{
"cve": "CVE-2017-6451",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6451"
}
],
"notes": [
{
"category": "general",
"text": "The mx4200_send function in the legacy MX4200 refclock in NTP before 4.2.8p10 and 4.3.x before 4.3.94 does not properly handle the return value of the snprintf function, which allows local users to execute arbitrary code via unspecified vectors, which trigger an out-of-bounds memory write.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6451",
"url": "https://www.suse.com/security/cve/CVE-2017-6451"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6451",
"url": "https://bugzilla.suse.com/1030050"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2017-6451"
},
{
"cve": "CVE-2017-6458",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6458"
}
],
"notes": [
{
"category": "general",
"text": "Multiple buffer overflows in the ctl_put* functions in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allow remote authenticated users to have unspecified impact via a long variable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6458",
"url": "https://www.suse.com/security/cve/CVE-2017-6458"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6458",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2017-6458"
},
{
"cve": "CVE-2017-6460",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6460"
}
],
"notes": [
{
"category": "general",
"text": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6460",
"url": "https://www.suse.com/security/cve/CVE-2017-6460"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6460",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2017-6460"
},
{
"cve": "CVE-2017-6462",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6462"
}
],
"notes": [
{
"category": "general",
"text": "Buffer overflow in the legacy Datum Programmable Time Server (DPTS) refclock driver in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows local users to have unspecified impact via a crafted /dev/datum device.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6462",
"url": "https://www.suse.com/security/cve/CVE-2017-6462"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6462",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2017-6462"
},
{
"cve": "CVE-2017-6463",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6463"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote authenticated users to cause a denial of service (daemon crash) via an invalid setting in a :config directive, related to the unpeer option.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6463",
"url": "https://www.suse.com/security/cve/CVE-2017-6463"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6463",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2017-6463"
},
{
"cve": "CVE-2017-6464",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-6464"
}
],
"notes": [
{
"category": "general",
"text": "NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote attackers to cause a denial of service (ntpd crash) via a malformed mode configuration directive.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-6464",
"url": "https://www.suse.com/security/cve/CVE-2017-6464"
},
{
"category": "external",
"summary": "SUSE Bug 1030050 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1030050"
},
{
"category": "external",
"summary": "SUSE Bug 1038049 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1038049"
},
{
"category": "external",
"summary": "SUSE Bug 1044525 for CVE-2017-6464",
"url": "https://bugzilla.suse.com/1044525"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.ppc64le",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.s390x",
"SUSE Linux Enterprise Server 12-LTSS:ntp-doc-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-4.2.8p10-46.23.1.x86_64",
"SUSE Linux Enterprise Server for SAP Applications 12:ntp-doc-4.2.8p10-46.23.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-04-18T14:06:17Z",
"details": "moderate"
}
],
"title": "CVE-2017-6464"
}
]
}
WID-SEC-W-2025-0370
Vulnerability from csaf_certbund - Published: 2017-09-25 22:00 - Updated: 2025-02-13 23:00Notes
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Apple Mac OS ist ein Betriebssystem, das auf FreeBSD und Mach basiert.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstelle in Apple Mac OS ausnutzen, um Code mit Kernel Privilegien auszuf\u00fchren, Sicherheitsvorkehrungen zu umgehen, einen Denial of Service Angriff durchzuf\u00fchren oder vertrauliche Daten einzusehen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-0370 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2017/wid-sec-w-2025-0370.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-0370 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0370"
},
{
"category": "external",
"summary": "Apple Security Advisory HT208144 vom 2017-09-25",
"url": "https://support.apple.com/de-de/HT208144"
},
{
"category": "external",
"summary": "Updated Apple Security Advisory HT208144 vom 2017-10-31",
"url": "https://lists.apple.com/archives/security-announce/2017/Oct/msg00007.html"
},
{
"category": "external",
"summary": "Updated Apple Security Advisory HT208144 vom 2017-10-31",
"url": "https://lists.apple.com/archives/security-announce/2017/Oct/msg00001.html"
}
],
"source_lang": "en-US",
"title": "Apple Mac OS: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-02-13T23:00:00.000+00:00",
"generator": {
"date": "2025-02-14T12:00:12.636+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.12"
}
},
"id": "WID-SEC-W-2025-0370",
"initial_release_date": "2017-09-25T22:00:00.000+00:00",
"revision_history": [
{
"date": "2017-09-25T22:00:00.000+00:00",
"number": "1",
"summary": "Initial Release"
},
{
"date": "2017-10-31T23:00:00.000+00:00",
"number": "2",
"summary": "cve added"
},
{
"date": "2017-10-31T23:00:00.000+00:00",
"number": "3",
"summary": "Version nicht vorhanden"
},
{
"date": "2017-10-31T23:00:00.000+00:00",
"number": "4",
"summary": "Version nicht vorhanden"
},
{
"date": "2017-11-21T23:00:00.000+00:00",
"number": "5",
"summary": "cve added"
},
{
"date": "2017-11-21T23:00:00.000+00:00",
"number": "6",
"summary": "Version nicht vorhanden"
},
{
"date": "2017-12-13T23:00:00.000+00:00",
"number": "7",
"summary": "New remediations available"
},
{
"date": "2025-02-13T23:00:00.000+00:00",
"number": "8",
"summary": "Korrektur"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c10.13",
"product": {
"name": "Apple macOS \u003c10.13",
"product_id": "T010822"
}
},
{
"category": "product_version",
"name": "10.13",
"product": {
"name": "Apple macOS 10.13",
"product_id": "T010822-fixed",
"product_identification_helper": {
"cpe": "cpe:/o:apple:mac_os:10.13"
}
}
}
],
"category": "product_name",
"name": "macOS"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-0736",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-0736"
},
{
"cve": "CVE-2016-2161",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-2161"
},
{
"cve": "CVE-2016-4736",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-4736"
},
{
"cve": "CVE-2016-5387",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-5387"
},
{
"cve": "CVE-2016-8740",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-8740"
},
{
"cve": "CVE-2016-8743",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-8743"
},
{
"cve": "CVE-2016-9042",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-9042"
},
{
"cve": "CVE-2016-9063",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-9063"
},
{
"cve": "CVE-2016-9840",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-9840"
},
{
"cve": "CVE-2016-9841",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-9841"
},
{
"cve": "CVE-2016-9842",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-9842"
},
{
"cve": "CVE-2016-9843",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2016-9843"
},
{
"cve": "CVE-2017-0381",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-0381"
},
{
"cve": "CVE-2017-1000100",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-1000100"
},
{
"cve": "CVE-2017-1000101",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-1000101"
},
{
"cve": "CVE-2017-1000373",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-1000373"
},
{
"cve": "CVE-2017-10140",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-10140"
},
{
"cve": "CVE-2017-10989",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-10989"
},
{
"cve": "CVE-2017-11103",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-11103"
},
{
"cve": "CVE-2017-11108",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-11108"
},
{
"cve": "CVE-2017-11541",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-11541"
},
{
"cve": "CVE-2017-11542",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-11542"
},
{
"cve": "CVE-2017-11543",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-11543"
},
{
"cve": "CVE-2017-12893",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12893"
},
{
"cve": "CVE-2017-12894",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12894"
},
{
"cve": "CVE-2017-12895",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12895"
},
{
"cve": "CVE-2017-12896",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12896"
},
{
"cve": "CVE-2017-12897",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12897"
},
{
"cve": "CVE-2017-12898",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12898"
},
{
"cve": "CVE-2017-12899",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12899"
},
{
"cve": "CVE-2017-12900",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12900"
},
{
"cve": "CVE-2017-12901",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12901"
},
{
"cve": "CVE-2017-12902",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12902"
},
{
"cve": "CVE-2017-12985",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12985"
},
{
"cve": "CVE-2017-12986",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12986"
},
{
"cve": "CVE-2017-12987",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12987"
},
{
"cve": "CVE-2017-12988",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12988"
},
{
"cve": "CVE-2017-12989",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12989"
},
{
"cve": "CVE-2017-12990",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12990"
},
{
"cve": "CVE-2017-12991",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12991"
},
{
"cve": "CVE-2017-12992",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12992"
},
{
"cve": "CVE-2017-12993",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12993"
},
{
"cve": "CVE-2017-12994",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12994"
},
{
"cve": "CVE-2017-12995",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12995"
},
{
"cve": "CVE-2017-12996",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12996"
},
{
"cve": "CVE-2017-12997",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12997"
},
{
"cve": "CVE-2017-12998",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12998"
},
{
"cve": "CVE-2017-12999",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-12999"
},
{
"cve": "CVE-2017-13000",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13000"
},
{
"cve": "CVE-2017-13001",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13001"
},
{
"cve": "CVE-2017-13002",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13002"
},
{
"cve": "CVE-2017-13003",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13003"
},
{
"cve": "CVE-2017-13004",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13004"
},
{
"cve": "CVE-2017-13005",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13005"
},
{
"cve": "CVE-2017-13006",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13006"
},
{
"cve": "CVE-2017-13007",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13007"
},
{
"cve": "CVE-2017-13008",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13008"
},
{
"cve": "CVE-2017-13009",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13009"
},
{
"cve": "CVE-2017-13010",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13010"
},
{
"cve": "CVE-2017-13011",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13011"
},
{
"cve": "CVE-2017-13012",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13012"
},
{
"cve": "CVE-2017-13013",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13013"
},
{
"cve": "CVE-2017-13014",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13014"
},
{
"cve": "CVE-2017-13015",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13015"
},
{
"cve": "CVE-2017-13016",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13016"
},
{
"cve": "CVE-2017-13017",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13017"
},
{
"cve": "CVE-2017-13018",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13018"
},
{
"cve": "CVE-2017-13019",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13019"
},
{
"cve": "CVE-2017-13020",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13020"
},
{
"cve": "CVE-2017-13021",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13021"
},
{
"cve": "CVE-2017-13022",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13022"
},
{
"cve": "CVE-2017-13023",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13023"
},
{
"cve": "CVE-2017-13024",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13024"
},
{
"cve": "CVE-2017-13025",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13025"
},
{
"cve": "CVE-2017-13026",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13026"
},
{
"cve": "CVE-2017-13027",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13027"
},
{
"cve": "CVE-2017-13028",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13028"
},
{
"cve": "CVE-2017-13029",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13029"
},
{
"cve": "CVE-2017-13030",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13030"
},
{
"cve": "CVE-2017-13031",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13031"
},
{
"cve": "CVE-2017-13032",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13032"
},
{
"cve": "CVE-2017-13033",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13033"
},
{
"cve": "CVE-2017-13034",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13034"
},
{
"cve": "CVE-2017-13035",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13035"
},
{
"cve": "CVE-2017-13036",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13036"
},
{
"cve": "CVE-2017-13037",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13037"
},
{
"cve": "CVE-2017-13038",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13038"
},
{
"cve": "CVE-2017-13039",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13039"
},
{
"cve": "CVE-2017-13040",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13040"
},
{
"cve": "CVE-2017-13041",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13041"
},
{
"cve": "CVE-2017-13042",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13042"
},
{
"cve": "CVE-2017-13043",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13043"
},
{
"cve": "CVE-2017-13044",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13044"
},
{
"cve": "CVE-2017-13045",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13045"
},
{
"cve": "CVE-2017-13046",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13046"
},
{
"cve": "CVE-2017-13047",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13047"
},
{
"cve": "CVE-2017-13048",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13048"
},
{
"cve": "CVE-2017-13049",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13049"
},
{
"cve": "CVE-2017-13050",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13050"
},
{
"cve": "CVE-2017-13051",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13051"
},
{
"cve": "CVE-2017-13052",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13052"
},
{
"cve": "CVE-2017-13053",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13053"
},
{
"cve": "CVE-2017-13054",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13054"
},
{
"cve": "CVE-2017-13055",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13055"
},
{
"cve": "CVE-2017-13077",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13077"
},
{
"cve": "CVE-2017-13078",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13078"
},
{
"cve": "CVE-2017-13080",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13080"
},
{
"cve": "CVE-2017-13687",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13687"
},
{
"cve": "CVE-2017-13688",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13688"
},
{
"cve": "CVE-2017-13689",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13689"
},
{
"cve": "CVE-2017-13690",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13690"
},
{
"cve": "CVE-2017-13725",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13725"
},
{
"cve": "CVE-2017-13782",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13782"
},
{
"cve": "CVE-2017-13786",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13786"
},
{
"cve": "CVE-2017-13799",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13799"
},
{
"cve": "CVE-2017-13800",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13800"
},
{
"cve": "CVE-2017-13801",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13801"
},
{
"cve": "CVE-2017-13804",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13804"
},
{
"cve": "CVE-2017-13807",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13807"
},
{
"cve": "CVE-2017-13808",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13808"
},
{
"cve": "CVE-2017-13809",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13809"
},
{
"cve": "CVE-2017-13810",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13810"
},
{
"cve": "CVE-2017-13811",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13811"
},
{
"cve": "CVE-2017-13812",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13812"
},
{
"cve": "CVE-2017-13813",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13813"
},
{
"cve": "CVE-2017-13814",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13814"
},
{
"cve": "CVE-2017-13815",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13815"
},
{
"cve": "CVE-2017-13816",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13816"
},
{
"cve": "CVE-2017-13817",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13817"
},
{
"cve": "CVE-2017-13818",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13818"
},
{
"cve": "CVE-2017-13819",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13819"
},
{
"cve": "CVE-2017-13820",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13820"
},
{
"cve": "CVE-2017-13821",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13821"
},
{
"cve": "CVE-2017-13822",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13822"
},
{
"cve": "CVE-2017-13823",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13823"
},
{
"cve": "CVE-2017-13824",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13824"
},
{
"cve": "CVE-2017-13825",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13825"
},
{
"cve": "CVE-2017-13826",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13826"
},
{
"cve": "CVE-2017-13827",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13827"
},
{
"cve": "CVE-2017-13828",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13828"
},
{
"cve": "CVE-2017-13829",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13829"
},
{
"cve": "CVE-2017-13830",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13830"
},
{
"cve": "CVE-2017-13831",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13831"
},
{
"cve": "CVE-2017-13832",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13832"
},
{
"cve": "CVE-2017-13833",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13833"
},
{
"cve": "CVE-2017-13834",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13834"
},
{
"cve": "CVE-2017-13836",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13836"
},
{
"cve": "CVE-2017-13837",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13837"
},
{
"cve": "CVE-2017-13838",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13838"
},
{
"cve": "CVE-2017-13839",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13839"
},
{
"cve": "CVE-2017-13840",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13840"
},
{
"cve": "CVE-2017-13841",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13841"
},
{
"cve": "CVE-2017-13842",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13842"
},
{
"cve": "CVE-2017-13843",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13843"
},
{
"cve": "CVE-2017-13846",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13846"
},
{
"cve": "CVE-2017-13851",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13851"
},
{
"cve": "CVE-2017-13854",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-13854"
},
{
"cve": "CVE-2017-3167",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-3167"
},
{
"cve": "CVE-2017-3169",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-3169"
},
{
"cve": "CVE-2017-6451",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6451"
},
{
"cve": "CVE-2017-6452",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6452"
},
{
"cve": "CVE-2017-6455",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6455"
},
{
"cve": "CVE-2017-6458",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6458"
},
{
"cve": "CVE-2017-6459",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6459"
},
{
"cve": "CVE-2017-6460",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6460"
},
{
"cve": "CVE-2017-6462",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6462"
},
{
"cve": "CVE-2017-6463",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6463"
},
{
"cve": "CVE-2017-6464",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-6464"
},
{
"cve": "CVE-2017-7074",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7074"
},
{
"cve": "CVE-2017-7077",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7077"
},
{
"cve": "CVE-2017-7078",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7078"
},
{
"cve": "CVE-2017-7080",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7080"
},
{
"cve": "CVE-2017-7082",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7082"
},
{
"cve": "CVE-2017-7083",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7083"
},
{
"cve": "CVE-2017-7084",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7084"
},
{
"cve": "CVE-2017-7086",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7086"
},
{
"cve": "CVE-2017-7114",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7114"
},
{
"cve": "CVE-2017-7119",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7119"
},
{
"cve": "CVE-2017-7121",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7121"
},
{
"cve": "CVE-2017-7122",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7122"
},
{
"cve": "CVE-2017-7123",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7123"
},
{
"cve": "CVE-2017-7124",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7124"
},
{
"cve": "CVE-2017-7125",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7125"
},
{
"cve": "CVE-2017-7126",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7126"
},
{
"cve": "CVE-2017-7127",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7127"
},
{
"cve": "CVE-2017-7128",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7128"
},
{
"cve": "CVE-2017-7129",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7129"
},
{
"cve": "CVE-2017-7130",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7130"
},
{
"cve": "CVE-2017-7132",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7132"
},
{
"cve": "CVE-2017-7138",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7138"
},
{
"cve": "CVE-2017-7141",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7141"
},
{
"cve": "CVE-2017-7143",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7143"
},
{
"cve": "CVE-2017-7144",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7144"
},
{
"cve": "CVE-2017-7659",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7659"
},
{
"cve": "CVE-2017-7668",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7668"
},
{
"cve": "CVE-2017-7679",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-7679"
},
{
"cve": "CVE-2017-9233",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-9233"
},
{
"cve": "CVE-2017-9788",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-9788"
},
{
"cve": "CVE-2017-9789",
"product_status": {
"known_affected": [
"T010822"
]
},
"release_date": "2017-09-25T22:00:00.000+00:00",
"title": "CVE-2017-9789"
}
]
}
CERTFR-2017-AVI-320
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Server versions ant\u00e9rieures \u00e0 5.4",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS High Sierra versions ant\u00e9rieures \u00e0 10.13",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iCloud pour Windows versions ant\u00e9rieures \u00e0 7.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-7127",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7127"
},
{
"name": "CVE-2017-7129",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7129"
},
{
"name": "CVE-2017-9233",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9233"
},
{
"name": "CVE-2017-7091",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7091"
},
{
"name": "CVE-2017-7121",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7121"
},
{
"name": "CVE-2017-7128",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7128"
},
{
"name": "CVE-2016-9842",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9842"
},
{
"name": "CVE-2017-7098",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7098"
},
{
"name": "CVE-2017-0381",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0381"
},
{
"name": "CVE-2017-7104",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7104"
},
{
"name": "CVE-2017-7111",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7111"
},
{
"name": "CVE-2017-7102",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7102"
},
{
"name": "CVE-2017-10979",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10979"
},
{
"name": "CVE-2017-7081",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7081"
},
{
"name": "CVE-2017-7120",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7120"
},
{
"name": "CVE-2017-7141",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7141"
},
{
"name": "CVE-2016-9840",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9840"
},
{
"name": "CVE-2017-7114",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7114"
},
{
"name": "CVE-2017-10978",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10978"
},
{
"name": "CVE-2017-7117",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7117"
},
{
"name": "CVE-2017-7126",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7126"
},
{
"name": "CVE-2017-7084",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7084"
},
{
"name": "CVE-2017-6451",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6451"
},
{
"name": "CVE-2016-9063",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9063"
},
{
"name": "CVE-2017-7093",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7093"
},
{
"name": "CVE-2017-7138",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7138"
},
{
"name": "CVE-2017-7094",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7094"
},
{
"name": "CVE-2016-9843",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9843"
},
{
"name": "CVE-2017-7109",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7109"
},
{
"name": "CVE-2017-7099",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7099"
},
{
"name": "CVE-2017-7087",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7087"
},
{
"name": "CVE-2017-7078",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7078"
},
{
"name": "CVE-2017-7077",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7077"
},
{
"name": "CVE-2017-7122",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7122"
},
{
"name": "CVE-2017-7083",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7083"
},
{
"name": "CVE-2017-7074",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7074"
},
{
"name": "CVE-2017-7080",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7080"
},
{
"name": "CVE-2017-7130",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7130"
},
{
"name": "CVE-2017-6455",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6455"
},
{
"name": "CVE-2017-7125",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7125"
},
{
"name": "CVE-2016-9841",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9841"
},
{
"name": "CVE-2017-6463",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6463"
},
{
"name": "CVE-2017-7119",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7119"
},
{
"name": "CVE-2017-7089",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7089"
},
{
"name": "CVE-2017-7096",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7096"
},
{
"name": "CVE-2017-6464",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6464"
},
{
"name": "CVE-2017-7095",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7095"
},
{
"name": "CVE-2017-7123",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7123"
},
{
"name": "CVE-2017-1000373",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1000373"
},
{
"name": "CVE-2017-7086",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7086"
},
{
"name": "CVE-2017-7090",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7090"
},
{
"name": "CVE-2017-7100",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7100"
},
{
"name": "CVE-2017-7106",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7106"
},
{
"name": "CVE-2017-6459",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6459"
},
{
"name": "CVE-2017-7092",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7092"
},
{
"name": "CVE-2017-7143",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7143"
},
{
"name": "CVE-2017-7082",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7082"
},
{
"name": "CVE-2017-7107",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7107"
},
{
"name": "CVE-2017-6452",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6452"
},
{
"name": "CVE-2017-11103",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-11103"
},
{
"name": "CVE-2017-6462",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6462"
},
{
"name": "CVE-2017-6460",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6460"
},
{
"name": "CVE-2017-7124",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7124"
},
{
"name": "CVE-2017-6458",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6458"
},
{
"name": "CVE-2017-10989",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10989"
},
{
"name": "CVE-2016-9042",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9042"
}
],
"links": [],
"reference": "CERTFR-2017-AVI-320",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-09-26T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de code\narbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT208102 du 25 septembre 2017",
"url": "https://support.apple.com/fr-fr/HT208102"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT208142 du 25 septembre 2017",
"url": "https://support.apple.com/fr-fr/HT208142"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT208144 du 25 septembre 2017",
"url": "https://support.apple.com/fr-fr/HT208144"
}
]
}
CERTFR-2017-AVI-320
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une exécution de code arbitraire et un déni de service à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
None| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "macOS Server versions ant\u00e9rieures \u00e0 5.4",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS High Sierra versions ant\u00e9rieures \u00e0 10.13",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iCloud pour Windows versions ant\u00e9rieures \u00e0 7.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2017-7127",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7127"
},
{
"name": "CVE-2017-7129",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7129"
},
{
"name": "CVE-2017-9233",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-9233"
},
{
"name": "CVE-2017-7091",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7091"
},
{
"name": "CVE-2017-7121",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7121"
},
{
"name": "CVE-2017-7128",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7128"
},
{
"name": "CVE-2016-9842",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9842"
},
{
"name": "CVE-2017-7098",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7098"
},
{
"name": "CVE-2017-0381",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-0381"
},
{
"name": "CVE-2017-7104",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7104"
},
{
"name": "CVE-2017-7111",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7111"
},
{
"name": "CVE-2017-7102",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7102"
},
{
"name": "CVE-2017-10979",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10979"
},
{
"name": "CVE-2017-7081",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7081"
},
{
"name": "CVE-2017-7120",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7120"
},
{
"name": "CVE-2017-7141",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7141"
},
{
"name": "CVE-2016-9840",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9840"
},
{
"name": "CVE-2017-7114",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7114"
},
{
"name": "CVE-2017-10978",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10978"
},
{
"name": "CVE-2017-7117",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7117"
},
{
"name": "CVE-2017-7126",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7126"
},
{
"name": "CVE-2017-7084",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7084"
},
{
"name": "CVE-2017-6451",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6451"
},
{
"name": "CVE-2016-9063",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9063"
},
{
"name": "CVE-2017-7093",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7093"
},
{
"name": "CVE-2017-7138",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7138"
},
{
"name": "CVE-2017-7094",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7094"
},
{
"name": "CVE-2016-9843",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9843"
},
{
"name": "CVE-2017-7109",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7109"
},
{
"name": "CVE-2017-7099",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7099"
},
{
"name": "CVE-2017-7087",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7087"
},
{
"name": "CVE-2017-7078",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7078"
},
{
"name": "CVE-2017-7077",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7077"
},
{
"name": "CVE-2017-7122",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7122"
},
{
"name": "CVE-2017-7083",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7083"
},
{
"name": "CVE-2017-7074",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7074"
},
{
"name": "CVE-2017-7080",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7080"
},
{
"name": "CVE-2017-7130",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7130"
},
{
"name": "CVE-2017-6455",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6455"
},
{
"name": "CVE-2017-7125",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7125"
},
{
"name": "CVE-2016-9841",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9841"
},
{
"name": "CVE-2017-6463",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6463"
},
{
"name": "CVE-2017-7119",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7119"
},
{
"name": "CVE-2017-7089",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7089"
},
{
"name": "CVE-2017-7096",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7096"
},
{
"name": "CVE-2017-6464",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6464"
},
{
"name": "CVE-2017-7095",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7095"
},
{
"name": "CVE-2017-7123",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7123"
},
{
"name": "CVE-2017-1000373",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-1000373"
},
{
"name": "CVE-2017-7086",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7086"
},
{
"name": "CVE-2017-7090",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7090"
},
{
"name": "CVE-2017-7100",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7100"
},
{
"name": "CVE-2017-7106",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7106"
},
{
"name": "CVE-2017-6459",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6459"
},
{
"name": "CVE-2017-7092",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7092"
},
{
"name": "CVE-2017-7143",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7143"
},
{
"name": "CVE-2017-7082",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7082"
},
{
"name": "CVE-2017-7107",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7107"
},
{
"name": "CVE-2017-6452",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6452"
},
{
"name": "CVE-2017-11103",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-11103"
},
{
"name": "CVE-2017-6462",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6462"
},
{
"name": "CVE-2017-6460",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6460"
},
{
"name": "CVE-2017-7124",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-7124"
},
{
"name": "CVE-2017-6458",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-6458"
},
{
"name": "CVE-2017-10989",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-10989"
},
{
"name": "CVE-2016-9042",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-9042"
}
],
"links": [],
"reference": "CERTFR-2017-AVI-320",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2017-09-26T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de code\narbitraire et un d\u00e9ni de service \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT208102 du 25 septembre 2017",
"url": "https://support.apple.com/fr-fr/HT208102"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT208142 du 25 septembre 2017",
"url": "https://support.apple.com/fr-fr/HT208142"
},
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Apple HT208144 du 25 septembre 2017",
"url": "https://support.apple.com/fr-fr/HT208144"
}
]
}
FKIE_CVE-2017-6460
Vulnerability from fkie_nvd - Published: 2017-03-27 17:59 - Updated: 2025-04-20 01:37| Vendor | Product | Version | |
|---|---|---|---|
| ntp | ntp | 4.2.8 | |
| ntp | ntp | 4.3.0 | |
| ntp | ntp | 4.3.1 | |
| ntp | ntp | 4.3.2 | |
| ntp | ntp | 4.3.3 | |
| ntp | ntp | 4.3.4 | |
| ntp | ntp | 4.3.5 | |
| ntp | ntp | 4.3.6 | |
| ntp | ntp | 4.3.7 | |
| ntp | ntp | 4.3.8 | |
| ntp | ntp | 4.3.9 | |
| ntp | ntp | 4.3.10 | |
| ntp | ntp | 4.3.11 | |
| ntp | ntp | 4.3.12 | |
| ntp | ntp | 4.3.13 | |
| ntp | ntp | 4.3.14 | |
| ntp | ntp | 4.3.15 | |
| ntp | ntp | 4.3.16 | |
| ntp | ntp | 4.3.17 | |
| ntp | ntp | 4.3.18 | |
| ntp | ntp | 4.3.19 | |
| ntp | ntp | 4.3.20 | |
| ntp | ntp | 4.3.21 | |
| ntp | ntp | 4.3.22 | |
| ntp | ntp | 4.3.23 | |
| ntp | ntp | 4.3.24 | |
| ntp | ntp | 4.3.25 | |
| ntp | ntp | 4.3.26 | |
| ntp | ntp | 4.3.27 | |
| ntp | ntp | 4.3.28 | |
| ntp | ntp | 4.3.29 | |
| ntp | ntp | 4.3.30 | |
| ntp | ntp | 4.3.31 | |
| ntp | ntp | 4.3.32 | |
| ntp | ntp | 4.3.33 | |
| ntp | ntp | 4.3.34 | |
| ntp | ntp | 4.3.35 | |
| ntp | ntp | 4.3.36 | |
| ntp | ntp | 4.3.37 | |
| ntp | ntp | 4.3.38 | |
| ntp | ntp | 4.3.39 | |
| ntp | ntp | 4.3.40 | |
| ntp | ntp | 4.3.41 | |
| ntp | ntp | 4.3.42 | |
| ntp | ntp | 4.3.43 | |
| ntp | ntp | 4.3.44 | |
| ntp | ntp | 4.3.45 | |
| ntp | ntp | 4.3.46 | |
| ntp | ntp | 4.3.47 | |
| ntp | ntp | 4.3.48 | |
| ntp | ntp | 4.3.49 | |
| ntp | ntp | 4.3.50 | |
| ntp | ntp | 4.3.51 | |
| ntp | ntp | 4.3.52 | |
| ntp | ntp | 4.3.53 | |
| ntp | ntp | 4.3.54 | |
| ntp | ntp | 4.3.55 | |
| ntp | ntp | 4.3.56 | |
| ntp | ntp | 4.3.57 | |
| ntp | ntp | 4.3.58 | |
| ntp | ntp | 4.3.59 | |
| ntp | ntp | 4.3.60 | |
| ntp | ntp | 4.3.61 | |
| ntp | ntp | 4.3.62 | |
| ntp | ntp | 4.3.63 | |
| ntp | ntp | 4.3.64 | |
| ntp | ntp | 4.3.65 | |
| ntp | ntp | 4.3.66 | |
| ntp | ntp | 4.3.67 | |
| ntp | ntp | 4.3.68 | |
| ntp | ntp | 4.3.69 | |
| ntp | ntp | 4.3.70 | |
| ntp | ntp | 4.3.71 | |
| ntp | ntp | 4.3.72 | |
| ntp | ntp | 4.3.73 | |
| ntp | ntp | 4.3.74 | |
| ntp | ntp | 4.3.75 | |
| ntp | ntp | 4.3.76 | |
| ntp | ntp | 4.3.77 | |
| ntp | ntp | 4.3.78 | |
| ntp | ntp | 4.3.79 | |
| ntp | ntp | 4.3.80 | |
| ntp | ntp | 4.3.81 | |
| ntp | ntp | 4.3.82 | |
| ntp | ntp | 4.3.83 | |
| ntp | ntp | 4.3.84 | |
| ntp | ntp | 4.3.85 | |
| ntp | ntp | 4.3.86 | |
| ntp | ntp | 4.3.87 | |
| ntp | ntp | 4.3.88 | |
| ntp | ntp | 4.3.89 | |
| ntp | ntp | 4.3.90 | |
| ntp | ntp | 4.3.91 | |
| ntp | ntp | 4.3.92 | |
| ntp | ntp | 4.3.93 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*",
"matchCriteriaId": "EE002C76-406D-4F22-B738-E17BDEA70BCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "0C1CCF6F-74C6-42D7-B88B-36ED73BB1F8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B23D9009-DF45-44C1-80DF-CEEC9B9E3F20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "43921601-667E-4415-83BE-E5B39D969BD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "75DD9C02-0C46-4785-8D77-C5465E4ED967",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "A497BADE-0516-494F-89FA-EAFC6AD17F7A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "4298439A-EAF2-4CAA-990B-4AA37E7A0E8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "30E9C822-C04A-4908-9596-76F9FB561206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "12EBD400-8EC1-4F9C-B600-85B8FF3BDEA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "BE6CFF4C-2620-4FD6-91A2-C0D0DAA4287D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*",
"matchCriteriaId": "842963D1-C78C-48B5-A8D2-BC018854E5CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*",
"matchCriteriaId": "121ED6C5-8985-4DEF-9040-2AC63582E596",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*",
"matchCriteriaId": "566B4B99-8B4F-4ED8-B2DC-D90EC71ECB99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.12:*:*:*:*:*:*:*",
"matchCriteriaId": "68499DA4-64EF-412F-A434-8E0F78D77CE9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.13:*:*:*:*:*:*:*",
"matchCriteriaId": "836C5AC9-463F-4703-81B9-7B5484F47A5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.14:*:*:*:*:*:*:*",
"matchCriteriaId": "FED14811-8F49-4796-BADD-DB7973EC32DF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.15:*:*:*:*:*:*:*",
"matchCriteriaId": "D4EB2830-ADE5-4C87-964E-16748BF88EF6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8C0284FD-2933-4160-80D2-53B32CD73287",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.17:*:*:*:*:*:*:*",
"matchCriteriaId": "D9AB963A-7284-433F-9890-5AE402E4E000",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.18:*:*:*:*:*:*:*",
"matchCriteriaId": "EEDEFF7A-D964-4D9A-93BF-41E9D16EA793",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.19:*:*:*:*:*:*:*",
"matchCriteriaId": "9C434153-911C-4F07-ADD0-0EAB47F96E89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.20:*:*:*:*:*:*:*",
"matchCriteriaId": "8183B043-8B96-4A8B-A5C9-544D4F1CED8D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.21:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE349AB-44CB-4263-80CE-59DFD572B363",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.22:*:*:*:*:*:*:*",
"matchCriteriaId": "3DB55DF6-567F-4B6A-81E1-9013914416D9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.23:*:*:*:*:*:*:*",
"matchCriteriaId": "80727B0B-AB5E-46CC-9DDF-F319C2D9B242",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.24:*:*:*:*:*:*:*",
"matchCriteriaId": "E0755962-2D5F-41E6-9BDB-C2ECBCCD2818",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.25:*:*:*:*:*:*:*",
"matchCriteriaId": "2EBAADB5-FA32-4CF9-A4B2-51EEA300B0EC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.26:*:*:*:*:*:*:*",
"matchCriteriaId": "A202FDAD-D757-4850-9D1E-C31B0F3BA718",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.27:*:*:*:*:*:*:*",
"matchCriteriaId": "B6A345D7-DFC0-4E0D-AAAB-8206C35F63D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.28:*:*:*:*:*:*:*",
"matchCriteriaId": "C4069EF5-DC7D-4487-8636-AC2EAB17BAC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.29:*:*:*:*:*:*:*",
"matchCriteriaId": "73DF3A5C-F1D9-468E-BD08-5E2578898DEA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.30:*:*:*:*:*:*:*",
"matchCriteriaId": "0858AE44-4B0A-4941-B4A8-937B557D1448",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.31:*:*:*:*:*:*:*",
"matchCriteriaId": "979C84FF-CB21-4819-B3CA-1A55FDF20BD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.32:*:*:*:*:*:*:*",
"matchCriteriaId": "94709B39-C394-4B44-A362-9429F4CB9D50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.33:*:*:*:*:*:*:*",
"matchCriteriaId": "2E4526AC-6BCC-43A5-B501-263D0ED0655B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.34:*:*:*:*:*:*:*",
"matchCriteriaId": "E04FF6B4-CD1C-4AC1-B286-D6AB705D680B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.35:*:*:*:*:*:*:*",
"matchCriteriaId": "1FAFA0C8-1349-43A4-BDAC-3B5A601B9FDE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.36:*:*:*:*:*:*:*",
"matchCriteriaId": "6BA130B1-DD20-4E98-963F-61E85A09E29E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.37:*:*:*:*:*:*:*",
"matchCriteriaId": "9AAC9B73-5020-47C9-803E-ABB6162AADE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.38:*:*:*:*:*:*:*",
"matchCriteriaId": "D2A6B7B5-3AC9-4442-BD91-3783C2B4235C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.39:*:*:*:*:*:*:*",
"matchCriteriaId": "D72F5C09-520B-486C-AD9A-9CBBFE6487CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.40:*:*:*:*:*:*:*",
"matchCriteriaId": "097DED37-D3F3-45C4-B131-1C4294406722",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.41:*:*:*:*:*:*:*",
"matchCriteriaId": "85A4F607-0A9D-4F84-B50D-28C54E6EDC06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.42:*:*:*:*:*:*:*",
"matchCriteriaId": "8C689CAF-632A-4FF2-8C86-541EEDD574E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.43:*:*:*:*:*:*:*",
"matchCriteriaId": "7B0ACF5B-BBA9-4B6C-B19D-B8AEF7212781",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.44:*:*:*:*:*:*:*",
"matchCriteriaId": "E09C8254-73DC-4AFA-A250-A8192DC917F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.45:*:*:*:*:*:*:*",
"matchCriteriaId": "D344FA12-3C5F-418B-9209-EA8BDD230074",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.46:*:*:*:*:*:*:*",
"matchCriteriaId": "D1C3A62A-C6F6-4B2E-A254-CDA12BD34DBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.47:*:*:*:*:*:*:*",
"matchCriteriaId": "073A0AFF-C5C6-422E-BD63-2353AA4B58E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.48:*:*:*:*:*:*:*",
"matchCriteriaId": "59B5DA29-4139-405D-8AA8-23FAECBBC5CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.49:*:*:*:*:*:*:*",
"matchCriteriaId": "73F4D15D-6D2A-4730-B7CF-21284E92FEFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.50:*:*:*:*:*:*:*",
"matchCriteriaId": "79A0C6AB-813F-4417-A98E-33FBB7AAB939",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.51:*:*:*:*:*:*:*",
"matchCriteriaId": "815ABF0E-ED94-4426-8889-D3C2AECACC26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.52:*:*:*:*:*:*:*",
"matchCriteriaId": "894612F1-8C51-4F66-AFE7-D8077F63E562",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.53:*:*:*:*:*:*:*",
"matchCriteriaId": "63FD3D1E-08F8-4C7F-876C-47E88386B83E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.54:*:*:*:*:*:*:*",
"matchCriteriaId": "9C068E27-A3DD-4FD2-81FB-2CFEC3C047CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.55:*:*:*:*:*:*:*",
"matchCriteriaId": "E21A12E6-0802-4BDC-AF71-50D7D0433B87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.56:*:*:*:*:*:*:*",
"matchCriteriaId": "DC7EE44A-7D8B-41A5-82A6-04AEE50278CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.57:*:*:*:*:*:*:*",
"matchCriteriaId": "6862529A-1AE5-4E2D-A4B0-E351D1900C64",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.58:*:*:*:*:*:*:*",
"matchCriteriaId": "4C6B6711-0F75-4FEA-8917-04391FC9D378",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.59:*:*:*:*:*:*:*",
"matchCriteriaId": "6AC0249C-3CFC-4CD3-9481-9F6BE1FC5E31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.60:*:*:*:*:*:*:*",
"matchCriteriaId": "3BE639D9-0B1E-4DFB-B275-D11665FDA4AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.61:*:*:*:*:*:*:*",
"matchCriteriaId": "B35E9C41-0F2A-4790-B996-8EC00FA863F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.62:*:*:*:*:*:*:*",
"matchCriteriaId": "28BAB268-3A70-4422-9C6C-49E6453D750D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.63:*:*:*:*:*:*:*",
"matchCriteriaId": "9A5960F1-DDA9-4885-952F-450EC00B5C9F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.64:*:*:*:*:*:*:*",
"matchCriteriaId": "E725D449-BBC2-40E3-BF53-D9BF7B4F57D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.65:*:*:*:*:*:*:*",
"matchCriteriaId": "B10975CB-56EB-44D0-BDEF-60484B6BD85E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.66:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE56C0F-0AF4-45CF-ACA2-0E583BBB3187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.67:*:*:*:*:*:*:*",
"matchCriteriaId": "16A4A1AC-ED08-4EFE-A826-1BB1B5CAB34E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.68:*:*:*:*:*:*:*",
"matchCriteriaId": "BF9D7AD6-6BDB-4519-B9F8-3181E21850FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.69:*:*:*:*:*:*:*",
"matchCriteriaId": "B061FF9A-0D00-429D-9B2F-14EEA41E7A33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.70:*:*:*:*:*:*:*",
"matchCriteriaId": "D6CB0260-2A96-41A8-81A0-8E9722B22D87",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.71:*:*:*:*:*:*:*",
"matchCriteriaId": "AE037065-9E33-4A5A-8188-1F086D7BE394",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.72:*:*:*:*:*:*:*",
"matchCriteriaId": "70200031-5902-416D-A140-DC2CDFDAF683",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.73:*:*:*:*:*:*:*",
"matchCriteriaId": "575C5F15-2C16-4B39-A718-1641DDD88F84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.74:*:*:*:*:*:*:*",
"matchCriteriaId": "9E7BFD7E-9B3F-4D63-BEBC-16F22DA6F8E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.75:*:*:*:*:*:*:*",
"matchCriteriaId": "42631437-772B-45E0-A1F3-5D9E2FC77D19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.76:*:*:*:*:*:*:*",
"matchCriteriaId": "CA9E62EF-E21F-421F-9A57-54A551CEC441",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.77:*:*:*:*:*:*:*",
"matchCriteriaId": "871E046E-013A-4E10-9457-4D1F407519EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.78:*:*:*:*:*:*:*",
"matchCriteriaId": "B5E4B06F-AD55-4D61-B966-B38B854C0A75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.79:*:*:*:*:*:*:*",
"matchCriteriaId": "19817731-42C2-4745-88F2-D27258FC7DB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.80:*:*:*:*:*:*:*",
"matchCriteriaId": "77479EEE-F81B-4653-8FAD-0AFBA3C71B09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.81:*:*:*:*:*:*:*",
"matchCriteriaId": "0208619E-9179-46D9-8E47-6CB5B4046DF9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.82:*:*:*:*:*:*:*",
"matchCriteriaId": "6FBAE2A2-B7CB-45F6-A84C-5B9B742A0B56",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.83:*:*:*:*:*:*:*",
"matchCriteriaId": "5CC16904-03FC-42B2-89F0-CA0D59A5FB91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.84:*:*:*:*:*:*:*",
"matchCriteriaId": "4E3980D1-54F1-4C2F-B140-B2F18D8958A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.85:*:*:*:*:*:*:*",
"matchCriteriaId": "0C845718-520A-42CB-9BA7-00723694A01F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.86:*:*:*:*:*:*:*",
"matchCriteriaId": "FAB7BF51-DD1A-41E1-B5E5-02A6BADC30DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.87:*:*:*:*:*:*:*",
"matchCriteriaId": "431DA557-0977-43C2-8DEF-127B1BAA9F46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.88:*:*:*:*:*:*:*",
"matchCriteriaId": "733C0A5D-3A0A-4449-9DE0-BD06D4942799",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.89:*:*:*:*:*:*:*",
"matchCriteriaId": "C9E5DAD5-465A-4A53-856A-1F674723EB00",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.90:*:*:*:*:*:*:*",
"matchCriteriaId": "B3FE37F4-C8E6-42CC-A799-563637F6B85A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.91:*:*:*:*:*:*:*",
"matchCriteriaId": "72F9DD05-E521-45D3-994E-0400DA0070BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.92:*:*:*:*:*:*:*",
"matchCriteriaId": "B5DA733E-A2BB-4F72-BE9A-AF1ADD1881A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ntp:ntp:4.3.93:*:*:*:*:*:*:*",
"matchCriteriaId": "816E4E2B-7E33-49A0-85E1-EF1755F6BB45",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response."
},
{
"lang": "es",
"value": "Desbordamiento de b\u00fafer basado en pila en la funci\u00f3n reslist en ntpq en NTP en versiones anteriores a 4.2.8p10 y 4.3.x en versiones anteriores a 4.3.94 permite a servidores remotos tener un impacto no especificado a trav\u00e9s de una variable flagstr larga en una respuesta de lista de restricciones."
}
],
"id": "CVE-2017-6460",
"lastModified": "2025-04-20T01:37:25.860",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": true,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2017-03-27T17:59:00.697",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97052"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1038123"
},
{
"source": "cve@mitre.org",
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
},
{
"source": "cve@mitre.org",
"url": "https://support.apple.com/HT208144"
},
{
"source": "cve@mitre.org",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97052"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1038123"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.apple.com/HT208144"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CNVD-2017-04230
Vulnerability from cnvd - Published: 2017-04-11目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: http://www.ntp.org/
| Name | ['Ntp NTPd <4.2.8p10', 'Ntp NTPd 4.3.x,<4.3.94'] |
|---|
{
"bids": {
"bid": {
"bidNumber": "97052"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2017-6460"
}
},
"description": "Network Time Protocol\uff08NTP\uff09\u662f\u7528\u6765\u4f7f\u8ba1\u7b97\u673a\u65f6\u95f4\u540c\u6b65\u5316\u7684\u4e00\u79cd\u534f\u8bae\u3002\r\n\r\nNTP\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5931\u8d25\u7684\u653b\u51fb\u4f1a\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
"discovererName": "unknown",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttp://www.ntp.org/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2017-04230",
"openTime": "2017-04-11",
"patchDescription": "Network Time Protocol\uff08NTP\uff09\u662f\u7528\u6765\u4f7f\u8ba1\u7b97\u673a\u65f6\u95f4\u540c\u6b65\u5316\u7684\u4e00\u79cd\u534f\u8bae\u3002\r\n\r\nNTP\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u5931\u8d25\u7684\u653b\u51fb\u4f1a\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "NTP\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2017-04230\uff09\u7684\u8865\u4e01",
"products": {
"product": [
"Ntp NTPd \u003c4.2.8p10",
"Ntp NTPd 4.3.x\uff0c\u003c4.3.94"
]
},
"referenceLink": "http://support.ntp.org/bin/view/Main/SecurityNotice#Recent_Vulnerabilities\r\nhttp://www.securityfocus.com/bid/97052",
"serverity": "\u4e2d",
"submitTime": "2017-03-23",
"title": "NTP\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff08CNVD-2017-04230\uff09"
}
GSD-2017-6460
Vulnerability from gsd - Updated: 2023-12-13 01:21{
"GSD": {
"alias": "CVE-2017-6460",
"description": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"id": "GSD-2017-6460",
"references": [
"https://www.suse.com/security/cve/CVE-2017-6460.html",
"https://ubuntu.com/security/CVE-2017-6460"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2017-6460"
],
"details": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response.",
"id": "GSD-2017-6460",
"modified": "2023-12-13T01:21:09.818295Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6460",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1038123",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id/1038123"
},
{
"name": "https://support.apple.com/HT208144",
"refsource": "CONFIRM",
"url": "https://support.apple.com/HT208144"
},
{
"name": "97052",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/97052"
},
{
"name": "http://support.ntp.org/bin/view/Main/NtpBug3377",
"refsource": "CONFIRM",
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"name": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu",
"refsource": "CONFIRM",
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us",
"refsource": "CONFIRM",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"name": "https://security.paloaltonetworks.com/CVE-2017-6460",
"refsource": "CONFIRM",
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.26:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.29:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.36:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.37:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.43:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.44:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.51:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.52:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.59:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.66:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.67:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.74:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.75:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.81:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.82:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.89:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.90:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.23:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.30:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.38:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.39:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.45:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.46:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.53:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.54:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.60:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.61:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.68:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.69:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.76:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.77:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.84:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.91:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.92:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.27:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.28:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.35:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.41:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.42:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.50:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.57:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.58:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.64:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.65:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.72:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.73:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.80:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.87:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.88:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.24:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.25:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.32:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.33:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.40:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.47:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.48:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.49:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.55:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.56:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.62:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.63:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.70:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.71:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.78:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.79:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.85:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.86:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.3.93:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6460"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Stack-based buffer overflow in the reslist function in ntpq in NTP before 4.2.8p10 and 4.3.x before 4.3.94 allows remote servers have unspecified impact via a long flagstr variable in a restriction list response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1038123",
"refsource": "SECTRACK",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securitytracker.com/id/1038123"
},
{
"name": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://support.ntp.org/bin/view/Main/SecurityNotice#March_2017_ntp_4_2_8p10_NTP_Secu"
},
{
"name": "http://support.ntp.org/bin/view/Main/NtpBug3377",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://support.ntp.org/bin/view/Main/NtpBug3377"
},
{
"name": "97052",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/97052"
},
{
"name": "https://support.apple.com/HT208144",
"refsource": "CONFIRM",
"tags": [],
"url": "https://support.apple.com/HT208144"
},
{
"name": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us",
"refsource": "CONFIRM",
"tags": [],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbux03962en_us"
},
{
"name": "https://security.paloaltonetworks.com/CVE-2017-6460",
"refsource": "CONFIRM",
"tags": [],
"url": "https://security.paloaltonetworks.com/CVE-2017-6460"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": true,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2017-10-24T01:29Z",
"publishedDate": "2017-03-27T17:59Z"
}
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.