CVE-2009-0021
Fixed in a distro release EPSS 3%
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
Products: ntp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | ntp | 1:4.2.4p4+dfsg-8 |
| Debian 4.0 | ntp | 1:4.2.2.p4+dfsg-2etch1 |
| Red Hat Enterprise Linux 4 | ntp | 0:4.2.0.a.20040617-8.el4_7.1 |
| Red Hat Enterprise Linux 4 | ntp-debuginfo | 0:4.2.0.a.20040617-8.el4_7.1 |
| Red Hat Enterprise Linux 5 | ntp | 0:4.2.2p1-9.el5_3.1 |
| Red Hat Enterprise Linux 5 | ntp-debuginfo | 0:4.2.2p1-9.el5_3.1 |