svn commit: r285169 - in head: contrib/ntp contrib/ntp/adjtimed contrib/ntp/clockstuff contrib/ntp/html contrib/ntp/html/drivers contrib/ntp/include contrib/ntp/include/isc contrib/ntp/kernel contr...

[Ian Lepore]

On Sun, 2015-07-05 at 09:54 -0700, Cy Schubert wrote:
> In message <1436113168.1191.1.camel at freebsd.org>, Ian Lepore writes:
> > On Sun, 2015-07-05 at 15:42 +0000, Cy Schubert wrote:
> > > Author: cy
> > > Date: Sun Jul  5 15:42:16 2015
> > > New Revision: 285169
> > > URL: https://svnweb.freebsd.org/changeset/base/285169
> > > 
> > > Log:
> > >   MFV ntp-4.2.8p3 (r284990).
> > >   
> > >   Approved by:	roberto, delphij
> > >   Security:	VuXML: 0d0f3050-1f69-11e5-9ba9-d050996490d0
> > >   Security:	http://bugs.ntp.org/show_bug.cgi?id=2853
> > >   Security:	https://www.kb.cert.org/vuls/id/668167
> > >   Security:	http://support.ntp.org/bin/view/Main/SecurityNotice#June_2015_N
> > TP_Security_Vulnerabi
> > 
> > While the checkin says 8.2.8p3, the new version identifies itself as:
> > 
> > Jan  1 00:00:24 wand ntpd[590]: ntpd 4.2.8 at 1.3265-o Mon May 25 22:33:20
> > UTC 2015 (1): Starting
> > 
> > compared to the prior import...
> > 
> > Jun  8 03:27:15 dpnand ntpd[61397]: ntpd 4.2.8p2-a (1): Starting
> > 
> > Is that expected?
> 
> My bad. That's a manual update that was missed. It's in 
> usr.sbin/ntp/config.h. Version has just been updated.

The crazy thing about this is that I was actually running an ntpd from
ports -- I had forgotten to reset rc.conf after testing a couple weeks
ago.  But somehow I reported a right problem, even though it was based
on wrong evidence. :)

-- Ian