From owner-freebsd-stable@freebsd.org Tue Dec 13 15:47:53 2016 Return-Path: Delivered-To: freebsd-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 79EC0C75C84 for ; Tue, 13 Dec 2016 15:47:53 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from tensor.andric.com (tensor.andric.com [IPv6:2001:7b8:3a7:1:2d0:b7ff:fea0:8c26]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "tensor.andric.com", Issuer "COMODO RSA Domain Validation Secure Server CA" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 42EC4AE5; Tue, 13 Dec 2016 15:47:53 +0000 (UTC) (envelope-from dim@FreeBSD.org) Received: from coleburn.avinity.tv (unknown [77.95.97.98]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by tensor.andric.com (Postfix) with ESMTPSA id 4683C12B21; Tue, 13 Dec 2016 16:47:51 +0100 (CET) Content-Type: multipart/signed; boundary="Apple-Mail=_D8314697-0EF4-46D6-B731-9E387C1007B0"; protocol="application/pgp-signature"; micalg=pgp-sha1 Mime-Version: 1.0 (Mac OS X Mail 9.3 \(3124\)) Subject: Re: CVE-2016-7434 NTP From: Dimitry Andric In-Reply-To: <584F5A6D.7070507@sorbs.net> Date: Tue, 13 Dec 2016 16:47:38 +0100 Cc: Xin LI , FreeBSD-STABLE Mailing List Message-Id: <2A50A786-514F-4F44-A2D4-4FD4436D74A3@FreeBSD.org> References: <5848EAB6.8040909@sorbs.net> <5AA6183C-44B5-4A0E-81E8-9B50FFE087F2@FreeBSD.org> <584F5A6D.7070507@sorbs.net> To: Michelle Sullivan X-Mailer: Apple Mail (2.3124) X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Dec 2016 15:47:53 -0000 --Apple-Mail=_D8314697-0EF4-46D6-B731-9E387C1007B0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=us-ascii On 13 Dec 2016, at 03:18, Michelle Sullivan wrote: > > Dimitry Andric wrote: >> On 08 Dec 2016, at 06:08, Michelle Sullivan wrote: >>> Are we going to get a patch for CVE-2016-7434 on FreeBSD 9.3? >> On Nov 22, in r309009, Xin Li merged ntp 4.2.8p9, which fixes this >> issue, to stable/9: >> >> https://svnweb.freebsd.org/changeset/base/309009 >> >> Unfortunately the commit message did not mention the CVE identifier. I >> can't find any corresponding security advisory either. ... > No updates needed to update system to 9.3-RELEASE-p52. > No updates are available to install. > Run '/usr/sbin/freebsd-update fetch' first. > [root@gauntlet /]# ntpd --version > ntpd 4.2.8p8-a (1) > > So no then... > > 9.3 is still so-say supported so I'm not talking about -STABLE. Well, as I mentioned, there was no Security Advisory (which is a little strange), so I didn't expect there to be any binary updates. As far as I know, binary updates are only built for Security Advisories and Errata Notices. -Dimitry --Apple-Mail=_D8314697-0EF4-46D6-B731-9E387C1007B0 Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP using GPGMail -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.30 iEYEARECAAYFAlhQGCYACgkQsF6jCi4glqPRfgCfbsp8WIAaP5LrUf0yNz938vyR UvYAoPhJzoXRDV2vNAmyrJKte6bXE6g9 =oYoM -----END PGP SIGNATURE----- --Apple-Mail=_D8314697-0EF4-46D6-B731-9E387C1007B0--