This host has NTP installed and is prone to security bypass vulnerability.

Successful exploitation could allow remote attackers to bypass the certificate validation checks and can cause spoofing attacks via signature checks on DSA and ECDSA keys used with SSL/TLS. Impact Level: System/Application

Upgrade to NTP version 4.2.4p6 or 4.2.5p151 http://www.ntp.org/downloads.html

The flaw is due to improper validation of return value in EVP_VerifyFinal function of openssl.

NTP version 4.2.4 to 4.2.4p5 and 4.2.5 to 4.2.5p150 on Linux.

• http://www.ocert.org/advisories/ocert-2008-016.html
• http://www.securityfocus.com/archive/1/499827
• http://www.securityfocus.com/archive/1/499855

---

Updated on 2015-03-25