taca 26035b39d0 Update ntp4 to 4.2.8p10 including security fixes. ... NTF's NTP Project is releasing ntp-4.2.8p10, which addresses: * 6 MEDIUM severity vulnerabilities (1 is about the Windows PPSAPI DLL) * 5 LOW severity vulnerabilities (2 are in the Windows Installer) * 4 Informational-level vulnerabilities * 15 other non-security fixes and improvements All of the security issues in this release are listed in VU#633849. ntp-4.2.8p10 was released on 21 March 2017. * Sec 3389 / CVE-2017-6464 / VU#325339: NTP-01-016 NTP: Denial of Service via Malformed Config (Pentest report 01.2017) - Reported by Cure53. * Sec 3388 / CVE-2017-6462 / VU#325339: NTP-01-014 NTP: Buffer Overflow in DPTS Clock (Pentest report 01.2017) - Reported by Cure53. * Sec 3387 / CVE-2017-6463 / VU#325339: NTP-01-012 NTP: Authenticated DoS via Malicious Config Option (Pentest report 01.2017) - Reported by Cure53. * Sec 3386: NTP-01-011 NTP: ntpq_stripquotes() returns incorrect Value (Pentest report 01.2017) - Reported by Cure53. * Sec 3385: NTP-01-010 NTP: ereallocarray()/eallocarray() underused (Pentest report 01.2017) - Reported by Cure53. * Sec 3384 / CVE-2017-6455 / VU#325339: NTP-01-009 NTP: Windows: Privileged execution of User Library code (Pentest report 01.2017) - Reported by Cure53. * Sec 3383 / CVE-2017-6452 / VU#325339: NTP-01-008 NTP: Windows Installer: Stack Buffer Overflow from Command Line (Pentest report 01.2017) - Reported by Cure53. * Sec 3382 / CVE-2017-6459 / VU#325339: NTP-01-007 NTP: Windows Installer: Data Structure terminated insufficiently (Pentest report 01.2017) - Reported by Cure53. * Sec 3381: NTP-01-006 NTP: Copious amounts of Unused Code (Pentest report 01.2017) - Reported by Cure53. * Sec 3380: NTP-01-005 NTP: Off-by-one in Oncore GPS Receiver (Pentest report 01.2017) - Reported by Cure53. * Sec 3379 / CVE-2017-6458 / VU#325339: NTP-01-004 NTP: Potential Overflows in ctl_put() functions (Pentest report 01.2017) - Reported by Cure53. * Sec 3378 / CVE-2017-6451 / VU#325339: NTP-01-003 Improper use of snprintf() in mx4200_send() (Pentest report 01.2017) - Reported by Cure53. * Sec 3377 / CVE-2017-6460 / VU#325339: NTP-01-002 Buffer Overflow in ntpq when fetching reslist (Pentest report 01.2017) - Reported by Cure53. * Sec 3376: NTP-01-001 Makefile does not enforce Security Flags (Pentest report 01.2017) - Reported by Cure53. * Sec 3361 / CVE-2016-9042 / VU#325339: 0rigin - Reported by Matthew Van Gundy of Cisco ASIG.		2017-03-24 03:41:08 +00:00
..
files
patches
DESCR
distinfo	Update ntp4 to 4.2.8p10 including security fixes.	2017-03-24 03:41:08 +00:00
Makefile	Update ntp4 to 4.2.8p10 including security fixes.	2017-03-24 03:41:08 +00:00
MESSAGE
options.mk	Do SNMP support properly, as a package option, default disabled.	2016-05-14 08:13:49 +00:00
PLIST	Fix package installation for Darwin, which installs tickadj and ntpsnmpd.	2016-05-13 15:50:13 +00:00