Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2009-0021

Опубликовано: 07 янв. 2009
Источник: nvd
CVSS2: 5
EPSS Низкий

Описание

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Комментарий

Note that versions 4.2.5 before 4.2.5p150 are development versions and not production versions. Development versions are not included in the CPE configuration for CVEs.

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
Версия до 4.2.4p4 (включая)
cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*

EPSS

Процентиль: 87%
0.03366
Низкий

5 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

ubuntu
больше 16 лет назад

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

redhat
больше 16 лет назад

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

debian
больше 16 лет назад

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly ...

github
около 3 лет назад

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

oracle-oval
больше 16 лет назад

ELSA-2009-0046: ntp security update (MODERATE)

EPSS

Процентиль: 87%
0.03366
Низкий

5 Medium

CVSS2

Дефекты

CWE-287