ntp security update

CentOS Errata and Security Advisory CESA-2009:0046

The Network Time Protocol (NTP) is used to synchronize a computer’s time
with a referenced time source.

A flaw was discovered in the way the ntpd daemon checked the return value
of the OpenSSL EVP_VerifyFinal function. On systems using NTPv4
authentication, this could lead to an incorrect verification of
cryptographic signatures, allowing time-spoofing attacks. (CVE-2009-0021)

Note: This issue only affects systems that have enabled NTP authentication.
By default, NTP authentication is not enabled.

All ntp users are advised to upgrade to the updated packages, which contain
a backported patch to resolve this issue. After installing the update, the
ntpd daemon will restart automatically.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2009-April/077916.html
https://lists.centos.org/pipermail/centos-announce/2009-April/077917.html
https://lists.centos.org/pipermail/centos-announce/2009-February/077764.html
https://lists.centos.org/pipermail/centos-announce/2009-February/077765.html

Affected packages:
ntp

Upstream details at:
https://access.redhat.com/errata/RHSA-2009:0046