NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: the upstream vendor has disputed this issue, stating "while we do misuse this function (this is a bug), it has absolutely no security ramification.

SunOS 5.10_x86: openssl patch.
Date this patch was last updated by Sun : Feb/24/09

Updated ntp packages to correct a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The Network Time Protocol (NTP) is used to synchronize a computer's time with a referenced time source.

A flaw was discovered in the way the ntpd daemon checked the return value of the OpenSSL EVP_VerifyFinal function. On systems using NTPv4 authentication, this could lead to an incorrect verification of cryptographic signatures, allowing time-spoofing attacks.
(CVE-2009-0021)

Note: This issue only affects systems that have enabled NTP authentication. By default, NTP authentication is not enabled.

All ntp users are advised to upgrade to the updated packages, which contain a backported patch to resolve this issue. After installing the update, the ntpd daemon will restart automatically.

a. Updated OpenSSL package for the Service Console fixes a    security issue.

   OpenSSL 0.9.7a-33.24 and earlier does not properly check the return    value from the EVP_VerifyFinal function, which could allow a remote    attacker to bypass validation of the certificate chain via a    malformed SSL/TLS signature for DSA and ECDSA keys.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-5077 to this issue.

b. Update bind package for the Service Console fixes a security issue.

   A flaw was discovered in the way Berkeley Internet Name Domain    (BIND) checked the return value of the OpenSSL DSA_do_verify    function. On systems using DNSSEC, a malicious zone could present    a malformed DSA certificate and bypass proper certificate    validation, allowing spoofing attacks.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-0025 to this issue.

c. Updated vim package for the Service Console addresses several    security issues.

   Several input flaws were found in Visual editor IMproved's (Vim)    keyword and tag handling. If Vim looked up a document's maliciously    crafted tag or keyword, it was possible to execute arbitrary code as    the user running Vim.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-4101 to this issue.

   A heap-based overflow flaw was discovered in Vim's expansion of file    name patterns with shell wildcards. An attacker could create a    specially crafted file or directory name, when opened by Vim causes    the application to stop responding or execute arbitrary code.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-3432 to this issue.

   Several input flaws were found in various Vim system functions. If a    user opened a specially crafted file, it was possible to execute    arbitrary code as the user running Vim.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-2712 to this issue.

   A format string flaw was discovered in Vim's help tag processor. If    a user was tricked into executing the 'helptags' command on    malicious data, arbitrary code could be executed with the    permissions of the user running VIM.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2007-2953 to this issue.

This update of libnasl adds missing return value checks for openssl function calls. (CVE-2009-0125)

It was discovered that NTP did not properly perform signature verification. A remote attacker could exploit this to bypass certificate validation via a malformed SSL/TLS signature.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Bind did not properly perform signature verification. When DNSSEC with DSA signatures are in use, a remote attacker could exploit this to bypass signature validation to spoof DNS entries and poison DNS caches. Among other things, this could lead to misdirected email and web traffic.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated Bind packages to correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols.

A flaw was discovered in the way BIND checked the return value of the OpenSSL DSA_do_verify function. On systems using DNSSEC, a malicious zone could present a malformed DSA certificate and bypass proper certificate validation, allowing spoofing attacks. (CVE-2009-0025)

For users of Red Hat Enterprise Linux 3 this update also addresses a bug which can cause BIND to occasionally exit with an assertion failure.

All BIND users are advised to upgrade to the updated package, which contains a backported patch to resolve this issue. After installing the update, BIND daemon will be restarted automatically.

It has been discovered that NTP, an implementation of the Network Time Protocol, does not properly check the result of an OpenSSL function for verifying cryptographic signatures, which may ultimately lead to the acceptance of unauthenticated time information. (Note that cryptographic authentication of time servers is often not enabled in the first place.)

It was discovered that OpenSSL does not properly verify DSA signatures on X.509 certificates due to an API misuse, potentially leading to the acceptance of incorrect X.509 certificates as genuine (CVE-2008-5077 ).

Updated OpenSSL packages that correct a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

OpenSSL is a toolkit that implements Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength, general purpose, cryptography library.

The Google security team discovered a flaw in the way OpenSSL checked the verification of certificates. An attacker in control of a malicious server, or able to effect a 'man in the middle' attack, could present a malformed SSL/TLS signature from a certificate chain to a vulnerable client and bypass validation. (CVE-2008-5077)

All OpenSSL users should upgrade to these updated packages, which contain backported patches to resolve these issues. For the update to take effect, all running OpenSSL client applications must be restarted, or the system rebooted.

ID	Name	Product	Family	Severity
108014	Solaris 10 (x86) : 139501-02	Nessus	Solaris Local Security Checks	medium
43728	CentOS 4 / 5 : ntp (CESA-2009:0046)	Nessus	CentOS Local Security Checks	medium
40389	VMSA-2009-0004 : ESX Service Console updates for openssl, bind, and vim	Nessus	VMware ESX Local Security Checks	high
40027	openSUSE Security Update : libnasl (libnasl-451)	Nessus	SuSE Local Security Checks	medium
37876	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : ntp vulnerability (USN-705-1)	Nessus	Ubuntu Local Security Checks	medium
36220	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : bind9 vulnerability (USN-706-1)	Nessus	Ubuntu Local Security Checks	medium
35589	CentOS 3 / 4 / 5 : bind (CESA-2009:0020)	Nessus	CentOS Local Security Checks	medium
35551	RHEL 4 / 5 : ntp (RHSA-2009:0046)	Nessus	Red Hat Local Security Checks	medium
35447	openSUSE 10 Security Update : libnasl (libnasl-5943)	Nessus	SuSE Local Security Checks	medium
35365	Debian DSA-1702-1 : ntp - interpretation conflict	Nessus	Debian Local Security Checks	medium
35364	Debian DSA-1701-1 : openssl, openssl097 - interpretation conflict	Nessus	Debian Local Security Checks	medium
35310	CentOS 3 / 4 / 5 : openssl (CESA-2009:0004)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2009-0125

high

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium