ntp: multiple issues

CVE-2015-7871 (authentication bypass)
An error handling logic error exists within ntpd that manifests due to improper
error condition handling associated with certain crypto-NAK packets. An
unauthenticated, off­-path attacker can force ntpd processes on targeted servers
to peer with time sources of the attacker’s choosing by transmitting symmetric
active crypto­-NAK packets to ntpd. This attack bypasses the authentication
typically required to establish a peer association and allows an attacker to
make arbitrary changes to system time. Matthew Van Gundy of Cisco ASIG is
credited with discovering this vulnerability. [1]

CVE-2015-7855 (denial of service)
decodenetnum() will ASSERT botch instead of returning FAIL on some bogus values.
This can cause a denial of service.

CVE-2015-7854 (memory corruption)
A potential buffer overflow vulnerability exists in the password management
functionality of ntp. A specially crafted key file could cause a buffer overflow
potentially resulting in memory being modified. An attacker could provide a
malicious password to trigger this vulnerability. [2]

CVE-2015-7849 (memory corruption)
An exploitable use-after-free vulnerability exists in the password management
functionality of the Network Time Protocol. A specially crafted key file could
cause a buffer overflow resulting in memory corruption. An attacker could
provide a malicious password file to trigger this vulnerability. [3]

CVE-2015-7852 (memory corruption)
A potential off by one vulnerability exists in the cookedprint functionality of
ntpq. A specially crafted buffer could cause a buffer overflow potentially
resulting in null byte being written out of bounds. [4]

CVE-2015-7853 (memory corruption)
A potential buffer overflow vulnerability exists in the refclock of ntpd. An
invalid length provided by a hardware reference clock could cause a buffer
overflow potentially resulting in memory being modified. A malicious reflock
could provide a negative length to trigger this vulnerability. [5]

CVE-2015-7848 (denial of service)
When processing a specially crafted private mode packet, an integer overflow can
occur leading to out of bounds memory copy operation. The crafted packet needs
to have the correct message authentication code and a valid timestamp. When
processed by the NTP daemon, it leads to an immediate crash. [6]

CVE-2015-7850 (denial of service)
An exploitable denial of service vulnerability exists in the remote
configuration functionality of the Network Time Protocol. A specially crafted
configuration file could cause an endless loop resulting in a denial of service.
An attacker could provide a the malicious configuration file to trigger this
vulnerability. [7]

CVE-2015-7851 (directory traversal)
A potential path traversal vulnerability exists in the config file saving of
ntpd on VMS. A specially crafted path could cause a path traversal potentially
resulting in files being overwritten. An attacker could provide a malicious path
to trigger this vulnerability. [8]

CVE-2015-7701 (memory leak)
Slow memory leak in CRYPTO_ASSOC.

CVE-2015-7702 (denial of service).
Incomplete autokey data packet length checks.

CVE-2015-7703 (directory traversal)
configuration directives "pidfile" and "driftfile" should only be allowed
locally.

CVE-2015-7704 (denial of service)
Clients that receive a KoD should validate the origin timestamp field.

CVE-2015-7705 (denial of service)
Clients that receive a KoD should validate the origin timestamp field.

CVE-2015-7691 (denial of service)
Incomplete autokey data packet length checks.

CVE-2015-7692 (denial of service
Incomplete autokey data packet length checks.