Package: ntp Version: 1:4.2.2.p4+dfsg-2 Severity: normal
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a different vulnerability than CVE-2008-5077 and CVE-2009-0025. http://www.ocert.org/advisories/ocert-2008-016.html http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0021 -- System Information: Debian Release: 4.0 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Shell: /bin/sh linked to /bin/bash Kernel: Linux 2.6.24-etchnhalf.1-amd64 Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US (charmap=ISO-8859-1) Versions of packages ntp depends on: ii adduser 3.102 Add and remove users and groups ii libc6 2.3.6.ds1-13etch8 GNU C Library: Shared libraries ii libcap1 1:1.10-14 support for getting/setting POSIX. ii libreadline5 5.2-2 GNU readline and history libraries ii libssl0.9.8 0.9.8c-4etch3 SSL shared libraries ii lsb-base 3.1-23.2etch1 Linux Standard Base 3.1 init scrip ii netbase 4.29 Basic TCP/IP networking system ii perl 5.8.8-7etch6 Larry Wall's Practical Extraction ntp recommends no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
