| Summary: | ntp new security issues from TALOS fixed upstream in 4.2.8p6 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | davidwhodgins, sysadmin-bugs, tarazed25 |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/674069/ | ||
| Whiteboard: | MGA5-64-OK MGA5-32-OK advisory | ||
| Source RPM: | ntp-4.2.6p5-24.3.mga5.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2016-01-25 02:53:42 CET
Notes to QA: 1) CVE-2015-8138 is the high severity issue. 2) Do not list CVE-2015-8139 or CVE-2015-8140 in the CVE list in the advisory in SVN, as we're not fixing those, only listing a mitigation. Other issues from the upstream advisory not fixed in this update... Do not affect us (only affect 4.2.8): http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7975 http://www.talosintel.com/reports/TALOS-2016-0072/ https://bugzilla.redhat.com/show_bug.cgi?id=1300267 Do affect us, but still not fixed: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7973 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7976 http://www.talosintel.com/reports/TALOS-2016-0070/ http://www.talosintel.com/reports/TALOS-2016-0073/ https://bugzilla.redhat.com/show_bug.cgi?id=1300266 https://bugzilla.redhat.com/show_bug.cgi?id=1300268 Additional statement for the advisory about the unfixed issues: Additionally, the other unfixed issues can also be mitigated. CVE-2015-7973, a replay attack issue, can be mitigated by not using broadcast mode, and CVE-2015-7976, a bug that can cause globbing issues on the server, can be mitigated by restricting use of the "saveconfig" command with the "restrict nomodify" directive. mga5 x86_64 Mate Experimented with ntp and the hardware clock before updating but failed to fins a way to affect the system time. Example follows. # systemctl stop ntpd.service # OK [root@vega lcl]# hwclock -r Mon 25 Jan 2016 08:34:35 GMT -0.937759 seconds [root@vega lcl]# hwclock --set --date="2016-01-25 07:09:10" [root@vega lcl]# hwclock -r Mon 25 Jan 2016 07:09:59 GMT -0.285900 seconds [root@vega lcl]# hwclock --hctosys [root@vega lcl]# hwclock -r Mon 25 Jan 2016 07:14:31 GMT -0.812774 seconds This had no effect on the time displayed in the panel which continued updating to the actual time (UT). Resynced with the hardware clock: # hwclock --hctosys Conclusion = no simple way to test this. Installed the update candidate packages and enabled the ntpd service. The time certainly looks correct. The hardware clock agrees to the second with my radio clock which is also in sync with the displayed time. CC:
(none) =>
tarazed25 mga5 i586 virtualbox Mate Replaced the incumbent ntp with the update candidate and cheked that the ntp daemon was running. It was. The system time agrees with the hardware clock to a fifth of a second and they keep in time with my radio-controlled clock. Looks good.
Len Lawrence
2016-01-25 13:48:37 CET
Whiteboard:
(none) =>
MGA5-64-OK MGA5-32-OK RedHat has issued an advisory for the most serious issue, CVE-2015-8138: https://rhn.redhat.com/errata/RHSA-2016-0063.html from http://lwn.net/Vulnerabilities/673451/
Dave Hodgins
2016-01-26 18:20:01 CET
Keywords:
(none) =>
validated_update An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0039.html Status:
NEW =>
RESOLVED
David Walser
2016-01-29 20:43:39 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/674069/ Fedora has issued an advisory for this on January 30: https://lists.fedoraproject.org/pipermail/package-announce/2016-January/176434.html (In reply to David Walser from comment #1) > Do not affect us (only affect 4.2.8): > http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7975 > http://www.talosintel.com/reports/TALOS-2016-0072/ > https://bugzilla.redhat.com/show_bug.cgi?id=1300267 > > Do affect us, but still not fixed: > http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7973 > http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7976 > http://www.talosintel.com/reports/TALOS-2016-0070/ > http://www.talosintel.com/reports/TALOS-2016-0073/ > https://bugzilla.redhat.com/show_bug.cgi?id=1300266 > https://bugzilla.redhat.com/show_bug.cgi?id=1300268 LWN reference: http://lwn.net/Vulnerabilities/677115/ LWN reference for CVE-2015-8139 and CVE-2015-8140: http://lwn.net/Vulnerabilities/685493/ |