To: [email protected]Subject: [ MDVSA-2009:117 ] ntp
Date: Tue, 19 May 2009 16:50:00 +0200
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1M6Qdk-0001H0-Jt@titan.mandriva.com.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2009:117
http://www.mandriva.com/security/
_______________________________________________________________________
Package : ntp
Date : May 19, 2009
Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
A vulnerability has been found and corrected in ntp:
A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
authentication code. If ntpd was configured to use public key
cryptography for NTP packet authentication, a remote attacker could
use this flaw to send a specially-crafted request packet that could
crash ntpd (CVE-2009-1252).
The updated packages have been patched to prevent this.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.1:
1d882a7929233e5ca6421cf6c17647c3 2008.1/i586/ntp-4.2.4-15.3mdv2008.1.i586.rpm
3b49b365ae0070f4f24ff6f6aaea9fce 2008.1/i586/ntp-client-4.2.4-15.3mdv2008.1.i586.rpm
b03b71b20835b7236bd066157de952aa 2008.1/i586/ntp-doc-4.2.4-15.3mdv2008.1.i586.rpm
681aa840ad8232b93df44f5bf2e22edd 2008.1/SRPMS/ntp-4.2.4-15.3mdv2008.1.src.rpm
Mandriva Linux 2008.1/X86_64:
ebe05407ba6991d29b97229e334bb462 2008.1/x86_64/ntp-4.2.4-15.3mdv2008.1.x86_64.rpm
f66ff4c9a3f7460d601e894b29dce35a 2008.1/x86_64/ntp-client-4.2.4-15.3mdv2008.1.x86_64.rpm
68447ae88a14960ca4cea0771a1eaf42 2008.1/x86_64/ntp-doc-4.2.4-15.3mdv2008.1.x86_64.rpm
681aa840ad8232b93df44f5bf2e22edd 2008.1/SRPMS/ntp-4.2.4-15.3mdv2008.1.src.rpm
Mandriva Linux 2009.0:
9b976f0f58f698028305912d1373bf5a 2009.0/i586/ntp-4.2.4-18.3mdv2009.0.i586.rpm
b83effb5ee3ec30e0789bb8ea002880b 2009.0/i586/ntp-client-4.2.4-18.3mdv2009.0.i586.rpm
bda0ecab0c1e2430bd9a41f6971780aa 2009.0/i586/ntp-doc-4.2.4-18.3mdv2009.0.i586.rpm
336b5f097aa91fd62032c60d3ab93bba 2009.0/SRPMS/ntp-4.2.4-18.3mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
9b6194897b6de17c86abb9a2cb84ae51 2009.0/x86_64/ntp-4.2.4-18.3mdv2009.0.x86_64.rpm
1ee97fea7efd86fe3add5fba4ecfec2c 2009.0/x86_64/ntp-client-4.2.4-18.3mdv2009.0.x86_64.rpm
ec4a015047af577bb4fb5193ebc73b5a 2009.0/x86_64/ntp-doc-4.2.4-18.3mdv2009.0.x86_64.rpm
336b5f097aa91fd62032c60d3ab93bba 2009.0/SRPMS/ntp-4.2.4-18.3mdv2009.0.src.rpm
Mandriva Linux 2009.1:
467390878db0dfe74f8833ab476bd47f 2009.1/i586/ntp-4.2.4-22.1mdv2009.1.i586.rpm
cbc18f35b2bbf0b7c13c44145758f399 2009.1/i586/ntp-client-4.2.4-22.1mdv2009.1.i586.rpm
5fa7a3622d2dffb199d8cf6b002ff9f1 2009.1/i586/ntp-doc-4.2.4-22.1mdv2009.1.i586.rpm
e72c4addf0675ed818481cb713ccdf38 2009.1/SRPMS/ntp-4.2.4-22.1mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
3dcdba167a28697ceca9e95d28738f59 2009.1/x86_64/ntp-4.2.4-22.1mdv2009.1.x86_64.rpm
6546b3440fbc7d6495fb379858253955 2009.1/x86_64/ntp-client-4.2.4-22.1mdv2009.1.x86_64.rpm
56b1b03967370acb70a461bff6edb596 2009.1/x86_64/ntp-doc-4.2.4-22.1mdv2009.1.x86_64.rpm
e72c4addf0675ed818481cb713ccdf38 2009.1/SRPMS/ntp-4.2.4-22.1mdv2009.1.src.rpm
Corporate 3.0:
a0176552645161d59f540e6399a91f01 corporate/3.0/i586/ntp-4.2.0-2.3.C30mdk.i586.rpm
ad819672d9f5c7245285ce272c8cbc57 corporate/3.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
aacc68ce9aac646ecc29223170a71a0e corporate/3.0/x86_64/ntp-4.2.0-2.3.C30mdk.x86_64.rpm
ad819672d9f5c7245285ce272c8cbc57 corporate/3.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm
Corporate 4.0:
e4ff06fde6e3ec13f50dbe036fed9bfd corporate/4.0/i586/ntp-4.2.0-21.5.20060mlcs4.i586.rpm
aa58f14a5ffbe83eaf53d52901dd8673 corporate/4.0/i586/ntp-client-4.2.0-21.5.20060mlcs4.i586.rpm
17d04e589fe4a88f183b35e5e81175b9 corporate/4.0/SRPMS/ntp-4.2.0-21.5.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
e7a778b0189e74eca2fb98f2e22bb0ee corporate/4.0/x86_64/ntp-4.2.0-21.5.20060mlcs4.x86_64.rpm
a3ad12c1b3e4abfd685bd247ba168680 corporate/4.0/x86_64/ntp-client-4.2.0-21.5.20060mlcs4.x86_64.rpm
17d04e589fe4a88f183b35e5e81175b9 corporate/4.0/SRPMS/ntp-4.2.0-21.5.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
f13ae773e9d3afddc4f67ff07d70983e mnf/2.0/i586/ntp-4.2.0-2.3.C30mdk.i586.rpm
cd9135f51b67d4c2d1a924cc2b859b16 mnf/2.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKEpnUmqjQ0CJFipgRAsJEAKDA8K7+ZPW4ASM10n7s/gGttBZtdgCeOXt6
e9UFvM9jPZgCLy7V7YZNGV0=
=y1lt
-----END PGP SIGNATURE-----
