CVE-2009-0021

Published: Jan 7, 2009Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Affected (6)

Products: Ntp: Ntp

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	Up to 4.2.4p4
Ntp Ntp	Version 4.2.0
Ntp Ntp	Version 4.2.2
Ntp Ntp	Version 4.2.4p1
Ntp Ntp	Version 4.2.4p2
Ntp Ntp	Version 4.2.4p3

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (38)

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

Source: secalert@redhat.com

http://secunia.com/advisories/33406

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/33558

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/33648

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34642

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35074

Source: secalert@redhat.com

Vendor Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.531177

Source: secalert@redhat.com

http://support.apple.com/kb/HT3549

Source: secalert@redhat.com

http://www.ocert.org/advisories/ocert-2008-016.html

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0046.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/499827/100/0/threaded

Source: secalert@redhat.com

http://www.securitytracker.com/id?1021533

Source: secalert@redhat.com

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: secalert@redhat.com

US Government Resource

http://www.vupen.com/english/advisories/2009/0042

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/1297

Source: secalert@redhat.com

Vendor Advisory

https://lists.ntp.org/pipermail/announce/2009-January/000055.html

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10035

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00000.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/33406

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33558

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/33648

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/34642

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/35074

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.531177

Source: af854a3a-2127-422b-91ae-364da2661108

http://support.apple.com/kb/HT3549

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ocert.org/advisories/ocert-2008-016.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2009-0046.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/499827/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1021533

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-133A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2009/0042

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.vupen.com/english/advisories/2009/1297

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://lists.ntp.org/pipermail/announce/2009-January/000055.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10035

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.