[pkg-ntp-maintainers] Bug#511227: ntp: OpenSSL signature verification API misuse

[Steve Kostecke]

Package: ntp
Version: 1:4.2.2.p4+dfsg-2
Severity: normal


NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly 
check the return value from the OpenSSL EVP_VerifyFinal function, which 
allows remote attackers to bypass validation of the certificate chain 
via a malformed SSL/TLS signature, a different vulnerability than 
CVE-2008-5077 and CVE-2009-0025.

http://www.ocert.org/advisories/ocert-2008-016.html

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-0021

-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.24-etchnhalf.1-amd64
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US (charmap=ISO-8859-1)

Versions of packages ntp depends on:
ii  adduser                3.102             Add and remove users and groups
ii  libc6                  2.3.6.ds1-13etch8 GNU C Library: Shared libraries
ii  libcap1                1:1.10-14         support for getting/setting POSIX.
ii  libreadline5           5.2-2             GNU readline and history libraries
ii  libssl0.9.8            0.9.8c-4etch3     SSL shared libraries
ii  lsb-base               3.1-23.2etch1     Linux Standard Base 3.1 init scrip
ii  netbase                4.29              Basic TCP/IP networking system
ii  perl                   5.8.8-7etch6      Larry Wall's Practical Extraction 

ntp recommends no packages.

-- no debconf information