CVE-2015-5194: Input Validation
First published: Tue Aug 18 2015(Updated: )
It was found that ntpd could crash due to an uninitialized variable when processing malformed logconfig configuration commands, for example: ntpq -c ":config logconfig a" Upstream patch: <a href="http://bk.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA">http://bk.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA</a>
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Fedoraproject Fedora | =21 | |
| Fedoraproject Fedora | =22 | |
| SUSE Linux Enterprise Debuginfo | =11-sp2 | |
| SUSE Linux Enterprise Debuginfo | =11-sp3 | |
| SUSE Linux Enterprise Server | =10-sp4 | |
| SUSE Linux Enterprise Server | =11-sp2 | |
| SUSE Linux Enterprise Server | =11-sp3 | |
| SUSE Manager | =2.1 | |
| Suse Manager Proxy | =2.1 | |
| SUSE OpenStack Cloud | =5 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Hpc Node | =6.0 | |
| Redhat Enterprise Linux Hpc Node | =7.0 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Redhat Enterprise Linux Workstation | =7.0 | |
| Debian Debian Linux | =7.0 | |
| Debian Debian Linux | =8.0 | |
| Canonical Ubuntu Linux | =12.04 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =15.04 | |
| Canonical Ubuntu Linux | =15.10 | |
| NTP ntp | <=4.2.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bk.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1256681
- https://bodhi.fedoraproject.org/updates/FEDORA-2015-14211
- https://bodhi.fedoraproject.org/updates/FEDORA-2015-14212
- https://bodhi.fedoraproject.org/updates/FEDORA-2015-14213
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1239022
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1243937
- https://rhn.redhat.com/errata/RHSA-2016-0780.html
- https://rhn.redhat.com/errata/RHSA-2016-2583.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1254542
- http://bk1.ntp.org/ntp-dev/?PAGE=patch&REV=4c4fc141LwvcoGp-lLGhkAFp3ZvtrA
- http://lists.fedoraproject.org/pipermail/package-announce/2015-November/170926.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-October/169167.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00048.html
- http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00026.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00042.html
- http://rhn.redhat.com/errata/RHSA-2016-0780.html
- http://rhn.redhat.com/errata/RHSA-2016-2583.html
- http://www.debian.org/security/2015/dsa-3388
- http://www.openwall.com/lists/oss-security/2015/08/25/3
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/76475
- http://www.ubuntu.com/usn/USN-2783-1
- https://github.com/ntp-project/ntp/commit/553f2fa65865c31c5e3c48812cfd46176cffdd27
- https://www-01.ibm.com/support/docview.wss?uid=isg3T1024157
- https://www-01.ibm.com/support/docview.wss?uid=swg21985122
- https://www-01.ibm.com/support/docview.wss?uid=swg21986956
- https://www-01.ibm.com/support/docview.wss?uid=swg21988706
- https://www-01.ibm.com/support/docview.wss?uid=swg21989542
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-5194
- agent/tags
- agent/trending
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/21
- version/fedoraproject fedora/22
- vendor/suse
- canonical/suse linux enterprise debuginfo
- version/suse linux enterprise debuginfo/11-sp2
- version/suse linux enterprise debuginfo/11-sp3
- canonical/suse linux enterprise server
- version/suse linux enterprise server/10-sp4
- version/suse linux enterprise server/11-sp2
- version/suse linux enterprise server/11-sp3
- canonical/suse manager
- version/suse manager/2.1
- canonical/suse manager proxy
- version/suse manager proxy/2.1
- canonical/suse openstack cloud
- version/suse openstack cloud/5
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux hpc node
- version/redhat enterprise linux hpc node/6.0
- version/redhat enterprise linux hpc node/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/7.0
- version/debian debian linux/8.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/12.04
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/15.04
- version/canonical ubuntu linux/15.10
- vendor/ntp
- canonical/ntp ntp
- version/ntp ntp/4.2.7