Message-Id: <E1M6Qdk-0001H4-Nf@titan.mandriva.com>
Date: Tue, 19 May 2009 16:50:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2009:117 ] ntp


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2009:117
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : ntp
 Date    : May 19, 2009
 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been found and corrected in ntp:
 
 A buffer overflow flaw was discovered in the ntpd daemon's NTPv4
 authentication code. If ntpd was configured to use public key
 cryptography for NTP packet authentication, a remote attacker could
 use this flaw to send a specially-crafted request packet that could
 crash ntpd (CVE-2009-1252).
 
 The updated packages have been patched to prevent this.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.1:
 1d882a7929233e5ca6421cf6c17647c3  2008.1/i586/ntp-4.2.4-15.3mdv2008.1.i586.rpm
 3b49b365ae0070f4f24ff6f6aaea9fce  2008.1/i586/ntp-client-4.2.4-15.3mdv2008.1.i586.rpm
 b03b71b20835b7236bd066157de952aa  2008.1/i586/ntp-doc-4.2.4-15.3mdv2008.1.i586.rpm 
 681aa840ad8232b93df44f5bf2e22edd  2008.1/SRPMS/ntp-4.2.4-15.3mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 ebe05407ba6991d29b97229e334bb462  2008.1/x86_64/ntp-4.2.4-15.3mdv2008.1.x86_64.rpm
 f66ff4c9a3f7460d601e894b29dce35a  2008.1/x86_64/ntp-client-4.2.4-15.3mdv2008.1.x86_64.rpm
 68447ae88a14960ca4cea0771a1eaf42  2008.1/x86_64/ntp-doc-4.2.4-15.3mdv2008.1.x86_64.rpm 
 681aa840ad8232b93df44f5bf2e22edd  2008.1/SRPMS/ntp-4.2.4-15.3mdv2008.1.src.rpm

 Mandriva Linux 2009.0:
 9b976f0f58f698028305912d1373bf5a  2009.0/i586/ntp-4.2.4-18.3mdv2009.0.i586.rpm
 b83effb5ee3ec30e0789bb8ea002880b  2009.0/i586/ntp-client-4.2.4-18.3mdv2009.0.i586.rpm
 bda0ecab0c1e2430bd9a41f6971780aa  2009.0/i586/ntp-doc-4.2.4-18.3mdv2009.0.i586.rpm 
 336b5f097aa91fd62032c60d3ab93bba  2009.0/SRPMS/ntp-4.2.4-18.3mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 9b6194897b6de17c86abb9a2cb84ae51  2009.0/x86_64/ntp-4.2.4-18.3mdv2009.0.x86_64.rpm
 1ee97fea7efd86fe3add5fba4ecfec2c  2009.0/x86_64/ntp-client-4.2.4-18.3mdv2009.0.x86_64.rpm
 ec4a015047af577bb4fb5193ebc73b5a  2009.0/x86_64/ntp-doc-4.2.4-18.3mdv2009.0.x86_64.rpm 
 336b5f097aa91fd62032c60d3ab93bba  2009.0/SRPMS/ntp-4.2.4-18.3mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 467390878db0dfe74f8833ab476bd47f  2009.1/i586/ntp-4.2.4-22.1mdv2009.1.i586.rpm
 cbc18f35b2bbf0b7c13c44145758f399  2009.1/i586/ntp-client-4.2.4-22.1mdv2009.1.i586.rpm
 5fa7a3622d2dffb199d8cf6b002ff9f1  2009.1/i586/ntp-doc-4.2.4-22.1mdv2009.1.i586.rpm 
 e72c4addf0675ed818481cb713ccdf38  2009.1/SRPMS/ntp-4.2.4-22.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 3dcdba167a28697ceca9e95d28738f59  2009.1/x86_64/ntp-4.2.4-22.1mdv2009.1.x86_64.rpm
 6546b3440fbc7d6495fb379858253955  2009.1/x86_64/ntp-client-4.2.4-22.1mdv2009.1.x86_64.rpm
 56b1b03967370acb70a461bff6edb596  2009.1/x86_64/ntp-doc-4.2.4-22.1mdv2009.1.x86_64.rpm 
 e72c4addf0675ed818481cb713ccdf38  2009.1/SRPMS/ntp-4.2.4-22.1mdv2009.1.src.rpm

 Corporate 3.0:
 a0176552645161d59f540e6399a91f01  corporate/3.0/i586/ntp-4.2.0-2.3.C30mdk.i586.rpm 
 ad819672d9f5c7245285ce272c8cbc57  corporate/3.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 aacc68ce9aac646ecc29223170a71a0e  corporate/3.0/x86_64/ntp-4.2.0-2.3.C30mdk.x86_64.rpm 
 ad819672d9f5c7245285ce272c8cbc57  corporate/3.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm

 Corporate 4.0:
 e4ff06fde6e3ec13f50dbe036fed9bfd  corporate/4.0/i586/ntp-4.2.0-21.5.20060mlcs4.i586.rpm
 aa58f14a5ffbe83eaf53d52901dd8673  corporate/4.0/i586/ntp-client-4.2.0-21.5.20060mlcs4.i586.rpm 
 17d04e589fe4a88f183b35e5e81175b9  corporate/4.0/SRPMS/ntp-4.2.0-21.5.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 e7a778b0189e74eca2fb98f2e22bb0ee  corporate/4.0/x86_64/ntp-4.2.0-21.5.20060mlcs4.x86_64.rpm
 a3ad12c1b3e4abfd685bd247ba168680  corporate/4.0/x86_64/ntp-client-4.2.0-21.5.20060mlcs4.x86_64.rpm 
 17d04e589fe4a88f183b35e5e81175b9  corporate/4.0/SRPMS/ntp-4.2.0-21.5.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 f13ae773e9d3afddc4f67ff07d70983e  mnf/2.0/i586/ntp-4.2.0-2.3.C30mdk.i586.rpm 
 cd9135f51b67d4c2d1a924cc2b859b16  mnf/2.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKEpnUmqjQ0CJFipgRAsJEAKDA8K7+ZPW4ASM10n7s/gGttBZtdgCeOXt6
e9UFvM9jPZgCLy7V7YZNGV0=
=y1lt
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists