Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2009-1252

Published: 19/05/2009 Updated: 10/10/2018
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Ntp

Vulnerability Summary

Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP prior to 4.2.4p7 and 4.2.5 prior to 4.2.5p74, when OpenSSL and autokey are enabled, allows remote malicious users to execute arbitrary code via a crafted packet containing an extension field.

Vulnerable Product Search on Vulmon Subscribe to Product

ntp ntp 4.2.4p1

ntp ntp 4.2.4p2

ntp ntp 4.2.5p2

ntp ntp 4.2.5p3

ntp ntp 4.2.5p10

ntp ntp 4.2.5p11

ntp ntp 4.2.5p19

ntp ntp 4.2.5p20

ntp ntp 4.2.5p28

ntp ntp 4.2.5p29

ntp ntp 4.2.5p37

ntp ntp 4.2.5p38

ntp ntp 4.2.5p39

ntp ntp 4.2.5p46

ntp ntp 4.2.5p47

ntp ntp 4.2.5p54

ntp ntp 4.2.5p55

ntp ntp 4.2.5p63

ntp ntp 4.2.5p62

ntp ntp 4.2.5p64

ntp ntp 4.2.5p71

ntp ntp 4.2.5p73

ntp ntp 4.2.4p3

ntp ntp 4.2.4p4

ntp ntp 4.2.5p4

ntp ntp 4.2.5p5

ntp ntp 4.2.5p12

ntp ntp 4.2.5p13

ntp ntp 4.2.5p14

ntp ntp 4.2.5p21

ntp ntp 4.2.5p23

ntp ntp 4.2.5p30

ntp ntp 4.2.5p31

ntp ntp 4.2.5p40

ntp ntp 4.2.5p41

ntp ntp 4.2.5p48

ntp ntp 4.2.5p49

ntp ntp 4.2.5p56

ntp ntp 4.2.5p57

ntp ntp 4.2.5p65

ntp ntp 4.2.5p66

ntp ntp 4.2.4p5

ntp ntp 4.2.4p6

ntp ntp 4.2.5p6

ntp ntp 4.2.5p7

ntp ntp 4.2.5p15

ntp ntp 4.2.5p16

ntp ntp 4.2.5p24

ntp ntp 4.2.5p25

ntp ntp 4.2.5p32

ntp ntp 4.2.5p33

ntp ntp 4.2.5p43

ntp ntp 4.2.5p42

ntp ntp 4.2.5p50

ntp ntp 4.2.5p51

ntp ntp 4.2.5p58

ntp ntp 4.2.5p59

ntp ntp 4.2.5p67

ntp ntp 4.2.5p68

ntp ntp 4.2.4p0

ntp ntp 4.2.5p0

ntp ntp 4.2.5p1

ntp ntp 4.2.5p8

ntp ntp 4.2.5p9

ntp ntp 4.2.5p17

ntp ntp 4.2.5p18

ntp ntp 4.2.5p26

ntp ntp 4.2.5p27

ntp ntp 4.2.5p35

ntp ntp 4.2.5p36

ntp ntp 4.2.5p44

ntp ntp 4.2.5p45

ntp ntp 4.2.5p52

ntp ntp 4.2.5p53

ntp ntp 4.2.5p60

ntp ntp 4.2.5p61

ntp ntp 4.2.5p69

ntp ntp 4.2.5p70

Vendor Advisories

Debian CVElist Bug Report Logs: ntp: multiple security issues
Debian Bug report logs - #525373 ntp: multiple security issues Package: ntp; Maintainer for ntp is Debian NTP Team <ntp@packagesdebianorg>; Source for ntp is src:ntp (PTS, buildd, popcon) Reported by: Steffen Joeris <steffenjoeris@skolelinuxde> Date: Fri, 24 Apr 2009 03:19:31 UTC Severity: grave Tags: patch, sec ...
Ubuntu Security Notice: ntp vulnerabilities
A stack-based buffer overflow was discovered in ntpq If a user were tricked into connecting to a malicious ntp server, a remote attacker could cause a denial of service in ntpq, or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2009-0159) ...
Red Hat: Important: ntp security update
Synopsis Important: ntp security update Type/Severity Security Advisory: Important Topic An updated ntp package that fixes two security issues is now available forRed Hat Enterprise Linux 5This update has been rated as having important security impact by the RedHat Security Response Team Descript ...
Red Hat: Critical: ntp security update
Synopsis Critical: ntp security update Type/Severity Security Advisory: Critical Topic An updated ntp package that fixes two security issues is now available forRed Hat Enterprise Linux 4This update has been rated as having critical security impact by the RedHat Security Response Team Description ...

References

CWE-119https://launchpad.net/bugs/cve/2009-1252http://www.kb.cert.org/vuls/id/853097https://bugzilla.redhat.com/show_bug.cgi?id=499694http://rhn.redhat.com/errata/RHSA-2009-1039.htmlhttp://rhn.redhat.com/errata/RHSA-2009-1040.htmlhttps://support.ntp.org/bugs/show_bug.cgi?id=1151http://www.securityfocus.com/bid/35017http://secunia.com/advisories/35137http://www.securitytracker.com/id?1022243http://www.mandriva.com/security/advisories?name=MDVSA-2009:117http://www.vupen.com/english/advisories/2009/1361http://www.debian.org/security/2009/dsa-1801http://secunia.com/advisories/35169http://secunia.com/advisories/35166http://www.gentoo.org/security/en/glsa/glsa-200905-08.xmlhttp://secunia.com/advisories/35253http://secunia.com/advisories/35243http://secunia.com/advisories/35138http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0092https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.htmlhttp://secunia.com/advisories/35308http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlhttp://secunia.com/advisories/35336http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238http://security.freebsd.org/advisories/FreeBSD-SA-09:11.ntpd.aschttp://secunia.com/advisories/35416https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00293.htmlhttp://secunia.com/advisories/35388ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.aschttp://secunia.com/advisories/35630http://www.vupen.com/english/advisories/2009/3316http://secunia.com/advisories/37470http://www.vmware.com/security/advisories/VMSA-2009-0016.htmlhttp://secunia.com/advisories/37471https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6307https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11231https://usn.ubuntu.com/777-1/http://www.securityfocus.com/archive/1/507985/100/0/threadedhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=525373https://usn.ubuntu.com/777-1/https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/853097
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322cross-site request forgeryunauthorizedCVE-2024-33925reflected XSSCVE-2023-51580CVE-2023-51579CVE-2015-2051CVE-2023-51609
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook