Published: 07/01/2009 Updated: 11/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

NTP 4.2.4 prior to 4.2.4p5 and 4.2.5 prior to 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote malicious users to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ntp ntp 4.2.4p1
ntp ntp 4.2.2
ntp ntp 4.2.4p3
ntp ntp 4.2.4p2
ntp ntp
ntp ntp 4.2.0

Synopsis Moderate: ntp security update Type/Severity Security Advisory: Moderate Topic Updated ntp packages to correct a security issue are now available for RedHat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team Descripti ...

It was discovered that NTP did not properly perform signature verification A remote attacker could exploit this to bypass certificate validation via a malformed SSL/TLS signature ...

It has been discovered that NTP, an implementation of the Network Time Protocol, does not properly check the result of an OpenSSL function for verifying cryptographic signatures, which may ultimately lead to the acceptance of unauthenticated time information (Note that cryptographic authentication of time servers is often not enabled in the first ...

CWE-287 http://www.ocert.org/advisories/ocert-2008-016.html http://secunia.com/advisories/33406 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.531177 https://lists.ntp.org/pipermail/announce/2009-January/000055.html http://secunia.com/advisories/33558 http://secunia.com/advisories/33648 http://www.redhat.com/support/errata/RHSA-2009-0046.html http://www.securitytracker.com/id?1021533 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html http://secunia.com/advisories/34642 http://www.vupen.com/english/advisories/2009/1297 http://support.apple.com/kb/HT3549 http://secunia.com/advisories/35074 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://www.us-cert.gov/cas/techalerts/TA09-133A.html http://www.vupen.com/english/advisories/2009/0042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10035 http://www.securityfocus.com/archive/1/499827/100/0/threaded https://access.redhat.com/errata/RHSA-2009:0046 https://usn.ubuntu.com/705-1/https://nvd.nist.gov

CVE-2009-0021

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect