<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Oracle VM Security Advisory OVMSA-2009-0011<br>
<br>
The following updated rpms for Oracle VM 2.1 have been uploaded to the
Unbreakable Linux Network:<br>
<br>
i386:<br>
ntp-4.2.2p1-9.el5_3.2.i386.rpm<br>
<br>
<br>
SRPMS:<br>
<a class="moz-txt-link-freetext"
href="http://oss.oracle.com/oraclevm/server/SRPMS-updates/ntp-4.2.2p1-9.el5_3.2.src.rpm">http://oss.oracle.com/oraclevm/server/SRPMS-updates/ntp-4.2.2p1-9.el5_3.2.src.rpm</a><br>
<br>
<br>
Description of changes:<br>
<br>
</tt>
<pre>Following security fixes is released in this errata:</pre>
<tt><br>
<a linkindex="10"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0159">CVE-2009-0159</a><br>
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c
in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute
arbitrary code via a crafted response.<br>
<br>
<a linkindex="11"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1252">CVE-2009-1252</a><br>
Stack-based buffer overflow in the crypto_recv function in
ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74,
when OpenSSL and autokey are enabled, allows remote attackers to
execute arbitrary code via a crafted packet containing an extension
field.<br>
<br>
<a linkindex="16"
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0021">CVE-2009-0021</a><br>
NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly
check the return value from the OpenSSL EVP_VerifyFinal function,
which allows remote attackers to bypass validation of the certificate
chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a
similar vulnerability to CVE-2008-5077.</tt><br>
<br>
<tt>[4.2.2p1-9.el5_3.2]<br>
- fix buffer overflow when parsing Autokey association message <br>
(#500783, CVE-2009-1252)<br>
- fix buffer overflow in ntpq (#500783, CVE-2009-0159)<br>
<br>
[4.2.2p1-9.el5_3.1]<br>
- fix check for malformed signatures (#479698, CVE-2009-0021)<br>
<br>
[4.2.2p1-9.el5]<br>
- fix selecting multicast interface (#444106)<br>
- disable kernel discipline when -x option is used (#431729)<br>
<br>
[4.2.2p1-8.el5]<br>
- avoid use of uninitialized floating-point values in clock_select
(#250838)<br>
- generate man pages from html source, include config man pages
(#307271)<br>
- add note about paths and exit codes to ntpd man page (#242925,
#246568)<br>
- add section about exit codes to ntpd man page (#319591)<br>
- always return 0 in scriptlets<br>
<br>
[4.2.2p1-7.el5]<br>
- pass additional options to ntpdate (#240141)<br>
<br>
[4.2.2p1-6.el5]<br>
- fix broadcast client to accept broadcasts on 255.255.255.255 (#226958)<br>
- compile with crypto support on 64bit architectures (#239580)<br>
- add ncurses-devel to buildrequires (#239580)<br>
- exit with nonzero code if ntpd -q did not set clock (#240134)<br>
- fix return codes in init script (#240118)<br>
<br>
</tt>
</body>
</html>