CVE Vulnerabilities

CVE-2009-0021

Improper Authentication

Published: Jan 07, 2009 | Modified: Oct 11, 2018
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
4.3 MODERATE
AV:N/AC:M/Au:N/C:P/I:N/A:N
RedHat/V3
Ubuntu
MEDIUM

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Ntp Ntp * 4.2.4p4 (including)
Ntp Ntp 4.2.0 (including) 4.2.0 (including)
Ntp Ntp 4.2.2 (including) 4.2.2 (including)
Ntp Ntp 4.2.4p1 (including) 4.2.4p1 (including)
Ntp Ntp 4.2.4p2 (including) 4.2.4p2 (including)
Ntp Ntp 4.2.4p3 (including) 4.2.4p3 (including)
Red Hat Enterprise Linux 4 RedHat ntp-0:4.2.0.a.20040617-8.el4_7.1 *
Red Hat Enterprise Linux 5 RedHat ntp-0:4.2.2p1-9.el5_3.1 *
Ntp Ubuntu dapper *
Ntp Ubuntu devel *
Ntp Ubuntu gutsy *
Ntp Ubuntu hardy *
Ntp Ubuntu intrepid *
Ntp Ubuntu upstream *

Potential Mitigations

References