-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2009:117 http://www.mandriva.com/security/ _______________________________________________________________________ Package : ntp Date : May 19, 2009 Affected: 2008.1, 2009.0, 2009.1, Corporate 3.0, Corporate 4.0, Multi Network Firewall 2.0 _______________________________________________________________________ Problem Description: A vulnerability has been found and corrected in ntp: A buffer overflow flaw was discovered in the ntpd daemon's NTPv4 authentication code. If ntpd was configured to use public key cryptography for NTP packet authentication, a remote attacker could use this flaw to send a specially-crafted request packet that could crash ntpd (CVE-2009-1252). The updated packages have been patched to prevent this. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.1: 1d882a7929233e5ca6421cf6c17647c3 2008.1/i586/ntp-4.2.4-15.3mdv2008.1.i586.rpm 3b49b365ae0070f4f24ff6f6aaea9fce 2008.1/i586/ntp-client-4.2.4-15.3mdv2008.1.i586.rpm b03b71b20835b7236bd066157de952aa 2008.1/i586/ntp-doc-4.2.4-15.3mdv2008.1.i586.rpm 681aa840ad8232b93df44f5bf2e22edd 2008.1/SRPMS/ntp-4.2.4-15.3mdv2008.1.src.rpm Mandriva Linux 2008.1/X86_64: ebe05407ba6991d29b97229e334bb462 2008.1/x86_64/ntp-4.2.4-15.3mdv2008.1.x86_64.rpm f66ff4c9a3f7460d601e894b29dce35a 2008.1/x86_64/ntp-client-4.2.4-15.3mdv2008.1.x86_64.rpm 68447ae88a14960ca4cea0771a1eaf42 2008.1/x86_64/ntp-doc-4.2.4-15.3mdv2008.1.x86_64.rpm 681aa840ad8232b93df44f5bf2e22edd 2008.1/SRPMS/ntp-4.2.4-15.3mdv2008.1.src.rpm Mandriva Linux 2009.0: 9b976f0f58f698028305912d1373bf5a 2009.0/i586/ntp-4.2.4-18.3mdv2009.0.i586.rpm b83effb5ee3ec30e0789bb8ea002880b 2009.0/i586/ntp-client-4.2.4-18.3mdv2009.0.i586.rpm bda0ecab0c1e2430bd9a41f6971780aa 2009.0/i586/ntp-doc-4.2.4-18.3mdv2009.0.i586.rpm 336b5f097aa91fd62032c60d3ab93bba 2009.0/SRPMS/ntp-4.2.4-18.3mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: 9b6194897b6de17c86abb9a2cb84ae51 2009.0/x86_64/ntp-4.2.4-18.3mdv2009.0.x86_64.rpm 1ee97fea7efd86fe3add5fba4ecfec2c 2009.0/x86_64/ntp-client-4.2.4-18.3mdv2009.0.x86_64.rpm ec4a015047af577bb4fb5193ebc73b5a 2009.0/x86_64/ntp-doc-4.2.4-18.3mdv2009.0.x86_64.rpm 336b5f097aa91fd62032c60d3ab93bba 2009.0/SRPMS/ntp-4.2.4-18.3mdv2009.0.src.rpm Mandriva Linux 2009.1: 467390878db0dfe74f8833ab476bd47f 2009.1/i586/ntp-4.2.4-22.1mdv2009.1.i586.rpm cbc18f35b2bbf0b7c13c44145758f399 2009.1/i586/ntp-client-4.2.4-22.1mdv2009.1.i586.rpm 5fa7a3622d2dffb199d8cf6b002ff9f1 2009.1/i586/ntp-doc-4.2.4-22.1mdv2009.1.i586.rpm e72c4addf0675ed818481cb713ccdf38 2009.1/SRPMS/ntp-4.2.4-22.1mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: 3dcdba167a28697ceca9e95d28738f59 2009.1/x86_64/ntp-4.2.4-22.1mdv2009.1.x86_64.rpm 6546b3440fbc7d6495fb379858253955 2009.1/x86_64/ntp-client-4.2.4-22.1mdv2009.1.x86_64.rpm 56b1b03967370acb70a461bff6edb596 2009.1/x86_64/ntp-doc-4.2.4-22.1mdv2009.1.x86_64.rpm e72c4addf0675ed818481cb713ccdf38 2009.1/SRPMS/ntp-4.2.4-22.1mdv2009.1.src.rpm Corporate 3.0: a0176552645161d59f540e6399a91f01 corporate/3.0/i586/ntp-4.2.0-2.3.C30mdk.i586.rpm ad819672d9f5c7245285ce272c8cbc57 corporate/3.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm Corporate 3.0/X86_64: aacc68ce9aac646ecc29223170a71a0e corporate/3.0/x86_64/ntp-4.2.0-2.3.C30mdk.x86_64.rpm ad819672d9f5c7245285ce272c8cbc57 corporate/3.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm Corporate 4.0: e4ff06fde6e3ec13f50dbe036fed9bfd corporate/4.0/i586/ntp-4.2.0-21.5.20060mlcs4.i586.rpm aa58f14a5ffbe83eaf53d52901dd8673 corporate/4.0/i586/ntp-client-4.2.0-21.5.20060mlcs4.i586.rpm 17d04e589fe4a88f183b35e5e81175b9 corporate/4.0/SRPMS/ntp-4.2.0-21.5.20060mlcs4.src.rpm Corporate 4.0/X86_64: e7a778b0189e74eca2fb98f2e22bb0ee corporate/4.0/x86_64/ntp-4.2.0-21.5.20060mlcs4.x86_64.rpm a3ad12c1b3e4abfd685bd247ba168680 corporate/4.0/x86_64/ntp-client-4.2.0-21.5.20060mlcs4.x86_64.rpm 17d04e589fe4a88f183b35e5e81175b9 corporate/4.0/SRPMS/ntp-4.2.0-21.5.20060mlcs4.src.rpm Multi Network Firewall 2.0: f13ae773e9d3afddc4f67ff07d70983e mnf/2.0/i586/ntp-4.2.0-2.3.C30mdk.i586.rpm cd9135f51b67d4c2d1a924cc2b859b16 mnf/2.0/SRPMS/ntp-4.2.0-2.3.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFKEpnUmqjQ0CJFipgRAsJEAKDA8K7+ZPW4ASM10n7s/gGttBZtdgCeOXt6 e9UFvM9jPZgCLy7V7YZNGV0= =y1lt -----END PGP SIGNATURE-----