ubuntu/+source/ntp:ubuntu/precise-updates

Last commit made on 2016-10-05
Get this branch:
git clone -b ubuntu/precise-updates https://git.launchpad.net/ubuntu/+source/ntp
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
ubuntu/precise-updates
Repository:
lp:ubuntu/+source/ntp

Recent commits

fba865a... by Marc Deslauriers on 2016-10-05

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.11 to ubuntu/precise-security

Imported using git-ubuntu import.

Changelog parent: 98c1d27b2a0c2267fc691c4ffbae7a01c349293d

New changelog entries:
  * SECURITY UPDATE: Deja Vu replay attack on authenticated broadcast mode
    - debian/patches/CVE-2015-7973.patch: improve timestamp verification in
      include/ntp.h, ntpd/ntp_proto.c.
    - CVE-2015-7973
  * SECURITY UPDATE: impersonation between authenticated peers
    - debian/patches/CVE-2015-7974.patch: check key ID in ntpd/ntp_proto.c.
    - CVE-2015-7974
  * SECURITY UPDATE: ntpq saveconfig command allows dangerous characters in
    filenames
    - debian/patches/CVE-2015-7976.patch: check filename in
      ntpd/ntp_control.c.
    - CVE-2015-7976
  * SECURITY UPDATE: restrict list denial of service
    - debian/patches/CVE-2015-7977-7978.patch: improve restrict list
      processing in ntpd/ntp_request.c.
    - CVE-2015-7977
    - CVE-2015-7978
  * SECURITY UPDATE: authenticated broadcast mode off-path denial of
    service
    - debian/patches/CVE-2015-7979.patch: add more checks to
      ntpd/ntp_proto.c.
    - CVE-2015-7979
    - CVE-2016-1547
  * SECURITY UPDATE: Zero Origin Timestamp Bypass
    - debian/patches/CVE-2015-8138.patch: check p_org in ntpd/ntp_proto.c.
    - CVE-2015-8138
  * SECURITY UPDATE: potential infinite loop in ntpq
    - debian/patches/CVE-2015-8158.patch: add time checks to ntpdc/ntpdc.c,
      ntpq/ntpq.c.
    - CVE-2015-8158
  * SECURITY UPDATE: NTP statsdir cleanup cronjob insecure (LP: #1528050)
    - debian/ntp.cron.daily: fix security issues, patch thanks to halfdog!
    - CVE-2016-0727
  * SECURITY UPDATE: time spoofing via interleaved symmetric mode
    - debian/patches/CVE-2016-1548.patch: check for bogus packets in
      ntpd/ntp_proto.c.
    - CVE-2016-1548
  * SECURITY UPDATE: buffer comparison timing attacks
    - debian/patches/CVE-2016-1550.patch: use CRYPTO_memcmp in
      libntp/a_md5encrypt.c, sntp/crypto.c.
    - CVE-2016-1550
  * SECURITY UPDATE: DoS via duplicate IPs on unconfig directives
    - debian/patches/CVE-2016-2516.patch: improve logic in
      ntpd/ntp_request.c.
    - CVE-2016-2516
  * SECURITY UPDATE: denial of service via crafted addpeer
    - debian/patches/CVE-2016-2518.patch: check mode value in
      ntpd/ntp_request.c.
    - CVE-2016-2518
  * SECURITY UPDATE: denial of service via spoofed packets
    - debian/patches/CVE-2016-4954.patch: discard packet that fails tests
      in ntpd/ntp_proto.c.
    - CVE-2016-4954
  * SECURITY UPDATE: denial of service via spoofed crypto-NAK or incorrect
    MAC
    - debian/patches/CVE-2016-4955.patch: fix checks in ntpd/ntp_proto.c.
    - CVE-2016-4955
  * SECURITY UPDATE: denial of service via spoofed broadcast packet
    - debian/patches/CVE-2016-4956.patch: properly handle switch in
      broadcast interleaved mode in ntpd/ntp_proto.c.
    - CVE-2016-4956

98c1d27... by Eric Desrochers on 2016-01-25

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.9 to ubuntu/precise-proposed

Imported using git-ubuntu import.

Changelog parent: 06bac7658aefbe70e1173a4176c6ed53ad53c09d

New changelog entries:
  * ntpd rejects source UDP ports less than 123 as bogus (closes: #691412)
    - d/p/reject-UDP-ports-less-than-123-as-bogus.patch (LP: #1479652)

06bac76... by Cam Cope on 2016-01-19

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.8 to ubuntu/precise-proposed

Imported using git-ubuntu import.

Changelog parent: 74f152e6e251e5bb6306a9637273dd7a12f456d4

New changelog entries:
  * Use a single lockfile again - instead unlock the file before starting the
    init script. The lock sho uld be shared - both services can't run at the
    same time. (LP: #1125726)

74f152e... by Eric Desrochers on 2015-10-29

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.7 to ubuntu/precise-proposed

Imported using git-ubuntu import.

Changelog parent: eb8dd7d7b77204026671a6fc75fed92b14591f40

New changelog entries:
  * Fix use-after-free in routing socket code (closes: #795315)
    - debian/patches/use-after-free-in-routing-socket.patch:
      fix logic in ntpd/ntp_io.c (LP: #1481388)

eb8dd7d... by Marc Deslauriers on 2015-10-23

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.6 to ubuntu/precise-security

Imported using git-ubuntu import.

Changelog parent: 84820661128938b25d6c59fabb516fe61aafd19b

New changelog entries:
  * SECURITY UPDATE: denial of service via crafted NUL-byte in
    configuration directive
    - debian/patches/CVE-2015-5146.patch: properly validate command in
      ntpd/ntp_control.c.
    - CVE-2015-5146
  * SECURITY UPDATE: denial of service via malformed logconfig commands
    - debian/patches/CVE-2015-5194.patch: fix logconfig logic in
      ntpd/ntp_parser.y.
    - CVE-2015-5194
  * SECURITY UPDATE: denial of service via disabled statistics type
    - debian/patches/CVE-2015-5195.patch: handle unrecognized types in
      ntpd/ntp_config.c.
    - CVE-2015-5195
  * SECURITY UPDATE: file overwrite via remote pidfile and driftfile
    configuration directives
    - debian/patches/CVE-2015-5196.patch: disable remote configuration in
      ntpd/ntp_parser.y.
    - CVE-2015-5196
    - CVE-2015-7703
  * SECURITY UPDATE: denial of service via precision value conversion
    - debian/patches/CVE-2015-5219.patch: use ldexp for LOGTOD in
      include/ntp.h.
    - CVE-2015-5219
  * SECURITY UPDATE: timeshifting by reboot issue
    - debian/patches/CVE-2015-5300.patch: disable panic in
      ntpd/ntp_loopfilter.c.
    - CVE-2015-5300
  * SECURITY UPDATE: incomplete autokey data packet length checks
    - debian/patches/CVE-2015-7691.patch: add length and size checks to
      ntpd/ntp_crypto.c.
    - CVE-2015-7691
    - CVE-2015-7692
    - CVE-2015-7702
  * SECURITY UPDATE: memory leak in CRYPTO_ASSOC
    - debian/patches/CVE-2015-7701.patch: add missing free in
      ntpd/ntp_crypto.c.
    - CVE-2015-7701
  * SECURITY UPDATE: denial of service by spoofed KoD
    - debian/patches/CVE-2015-7704.patch: add check to ntpd/ntp_proto.c.
    - CVE-2015-7704
    - CVE-2015-7705
  * SECURITY UPDATE: denial of service via same logfile and keyfile
    - debian/patches/CVE-2015-7850.patch: rate limit errors in
      include/ntp_stdlib.h, include/ntp_syslog.h, libntp/authreadkeys.c,
      libntp/msyslog.c.
    - CVE-2015-7850
  * SECURITY UPDATE: ntpq atoascii memory corruption
    - debian/patches/CVE-2015-7852.patch: avoid buffer overrun in
      ntpq/ntpq.c.
    - CVE-2015-7852
  * SECURITY UPDATE: buffer overflow via custom refclock driver
    - debian/patches/CVE-2015-7853.patch: properly calculate length in
      ntpd/ntp_io.c.
    - CVE-2015-7853
  * SECURITY UPDATE: denial of service via ASSERT in decodenetnum
    - debian/patches/CVE-2015-7855.patch: simply return fail in
      libntp/decodenetnum.c.
    - CVE-2015-7855
  * SECURITY UPDATE: symmetric association authentication bypass via
    crypto-NAK
    - debian/patches/CVE-2015-7871.patch: drop unhandled packet in
      ntpd/ntp_proto.c.
    - CVE-2015-7871
  * debian/control: add bison to Build-Depends.
  * debian/rules: remove ntp/ntp_parser.{c,h} or they don't get properly
    regenerated for some reason.
  * This package does _not_ contain the changes from
    (1:4.2.6.p3+dfsg-1ubuntu3.5) in precise-proposed.

8482066... by Marc Deslauriers on 2015-04-13

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.4 to ubuntu/precise-security

Imported using git-ubuntu import.

Changelog parent: a9e7349cb97db2af6dfd55b6b10817b014819ecf

New changelog entries:
  * SECURITY UPDATE: symmetric key unauthenticated packet MITM attack
    - debian/patches/CVE-2015-1798.patch: reject packets without MAC in
      ntpd/ntp_proto.c.
    - CVE-2015-1798
  * SECURITY UPDATE: symmetric association DoS attack
    - debian/patches/CVE-2015-1799.patch: don't update state variables when
      authentication fails in ntpd/ntp_proto.c.
    - CVE-2015-1799
  * SECURITY UPDATE: ntp-keygen infinite loop or lack of randonmess on big
    endian platforms
    - debian/patches/ntp-keygen-endless-loop.patch: fix logic in
      util/ntp-keygen.c.
    - CVE number pending

a9e7349... by Marc Deslauriers on 2015-02-06

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.3 to ubuntu/precise-security

Imported using git-ubuntu import.

Changelog parent: 73ec5bf76f4c1f301b60a36c403f18666583fb69

New changelog entries:
  * SECURITY UPDATE: denial of service and possible info leakage via
    extension fields
    - debian/patches/CVE-2014-9297.patch: properly check lengths in
      ntpd/ntp_crypto.c, ntpd/ntp_proto.c.
    - CVE-2014-9297
  * SECURITY UPDATE: IPv6 ACL bypass
    - debian/patches/CVE-2014-9298.patch: check for spoofed ::1 in
      ntpd/ntp_io.c.
    - CVE-2014-9298

73ec5bf... by Marc Deslauriers on 2014-12-20

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.2 to ubuntu/precise-security

Imported using git-ubuntu import.

Changelog parent: 34e7b29c0f22376cf1ec3b3cf0f22bd36bca706a

New changelog entries:
  * SECURITY UPDATE: weak default key in config_auth()
    - debian/patches/CVE-2014-9293.patch: use openssl for random key in
      ntpd/ntp_config.c, ntpd/ntpd.c.
    - CVE-2014-9293
  * SECURITY UPDATE: non-cryptographic random number generator with weak
    seed used by ntp-keygen to generate symmetric keys
    - debian/patches/CVE-2014-9294.patch: use openssl for random key in
      include/ntp_random.h, libntp/ntp_random.c, util/ntp-keygen.c.
    - CVE-2014-9294
  * SECURITY UPDATE: buffer overflows in crypto_recv(), ctl_putdata(),
    configure()
    - debian/patches/CVE-2014-9295.patch: check lengths in
      ntpd/ntp_control.c, ntpd/ntp_crypto.c.
    - CVE-2014-9295
  * SECURITY UPDATE: missing return on error in receive()
    - debian/patches/CVE-2015-9296.patch: add missing return in
      ntpd/ntp_proto.c.
    - CVE-2014-9296

34e7b29... by Sebastien Bacher on 2012-06-04

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3.1 to ubuntu/precise-proposed

Imported using git-ubuntu import.

Changelog parent: 73d7c78eaf02fa692f841002261a1188b6f92cea

New changelog entries:
  * Re-enable crypto support by pointing openssl libdir to multiarch dir,
    change backported from Debian, thanks Yves-Alexis Perez (lp: #998403)

73d7c78... by Jamie Strandboge on 2012-03-06

Import patches-unapplied version 1:4.2.6.p3+dfsg-1ubuntu3 to ubuntu/precise

Imported using git-ubuntu import.

Changelog parent: 4b2a46993f5f36656820b61d0ab8d96fa34e5846

New changelog entries:
  * debian/apparmor-profile: Add samba4 ntp signing socket to ntpd apparmor
    profile (LP: #930266)
  * debian/control: Build-Depends on dh-apparmor