ECO kit NTP-083_A055

NTP-083_A055 - NTP ECO kit Rev 8.3 for MultiNet V5.5A	17-Sep-2018

    Copyright © 2010-2018 Process Software, LLC
 
    This kit updates MultiNet versions 5.4 Rev A and 5.5 Rev A with version
    ntpd 4.2.8p12. This corrects all vulnerabilities known as of
    August 14, 2018. 

    This kit contains the following images:
	MULTINET_SOCKET_LIBRARY.EXE - new entry points to resolve names to
	    addresses
	NTPD.EXE - the NTP time maintainence daemon.
	NTPDC.EXE - an NTP control program
	NTPQ.EXE - an NTP control program
	NTP_LIBLOCK.EXE - VMS Version specific routines.
	NTPDATE.EXE - NTPDATE from MultiNet 5.4 for MultiNet 5.5 systems.

	Note that the size of the images has increased because of use of
	additional cryptographic routines that don't currently have entry
	points in the cryptographic routines image provided with MultiNet.
    
    The ranking for this ECO is 3. The highest rank is 2.

    - Update to NTP 4.2.8p12 from NTP.ORG.  NTP-083_A055 17-Sep-2018

    - Correct a problem with processing address restriction (-4) in
      configuration lines that was accidentily introduced in an earlier patch.

    This implementation of NTPD has not had sufficient testing of the
    SLEW_ALWAYS configuration addition.

    - Reduce "Unexpected origin timestamp" messages. NTP-082_A055 19-Jun-2018

    - Improvements to name resolution. DE 6662 NTP-081-A055 21-May-2018

    - Update base code to NTP 4.2.8p11 to resolve a number of problems.
      (CVE-2016-1549, CVE-2018-7182, CVE-2018-7170, CVE-2018-7184,
       CVE-2018-7185) NTP-080_A055, ECO Rank 2 19-Mar-2018

    - Restore message about SLEW_ALWAYS being used. NTP-080_A055, ECO Rank 3

    - Update base code to NTP 4.2.8P10 to resolve a number of problems.
      (CVE-2017-6464, CVE-2017-6462, CVE-2017-6463, CVE-2017-6458,
      CVE-2017-6451, CVE-2017-6460, CVE-2016-9042) NTP-070_A055, ECO Rank 3

    - Provide an appropriate MULTINET_SOCKET_LIBRARY.EXE for the version of
      MultiNet being used. (NTP-061_A055, ECO Rank 3)

    - Correct a few more instances where address values could overflow the
      space available. (NTP-061_A055, ECO Rank 3)

    - Restore parsing of DISABLE OPCOM. (NTP-061_A055, ECO Rank 3)

    - Update base code to NTP 4.2.8P9 to resolve a number of problems.
      (CVE-2016-9311, CVE-2016-9310, CVE-2016-7427, CVE-2016-7428,
      CVE-2016-7431, CVE-2016-7434, CVE-2016-7429, CVE-2016, 7426,
      CVE-2016-7433) (NTP-060_a055, ECO Rank 2)

    - Correct an error that can cause stack corruption when servers with IPv6
      addresses are used.  On Alpha systems this can cause NTPD to be compute
      bound. (NTP-060_A055, ECO Rank 2)

    - Correct an error in the computation of the completion time for the "fall
      back" change from day light saving time to standard time. The error may
      cause the time to "fall back" more than once resulting in the wrong
      time. (NTP-050_A055, ECO Rank 2)

    - Provide the NTPDATE image, which was not included in MultiNet 5.5
      (NTP-048_A055, ECO Rank 3)

    - Improve recognition of ; as comment character.

    - Modifcations to NTPDATE to observe system time zone.

    - Correct a number of security problems. (CVEs 2015-7704, 2015-8138,
      2016-1547, 2016-1548, 2016-1549, 2016-1550, 2016-1551, 2016-2516,
      2016-2517, 2016-2518 and 2016-2519)
      (NTP-047_A055)

    - Correct parsing problem for LOCAL-MASTER and MASTER-SERVER.
	(NTP-046_A054)

    - Update MULTINET_SOCKET_LIBRARY.
	(NTP-045_A054)

    - Correct a memory leak in NTPD.
      (NTP-044_A054)

    - Set process /dump to produce a dump file when unexpected things happen.
      (NTP-043_A054)

    - Address a problem which can cause NTP to stop responding to the MultiNet
      Master Server. (NTP-042_A054)

    - Save the names resolved by responding to MULTINET NETC NTP SHOW
      so that they don't have to be resolved each time. (NTP-041_A054)

    - Add a start up delay for when the system has DNS clusters to allow time
      for the name server to get started.
      (NTP-040_A054)

    - Modification to NTPQ and NTPDC to allow them to be used from the
      MULTINET command. (NTP-032_A054)


MultiNet ECO, Process Software