Back to Database
Status published
Medium
CVE-2009-1252
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in...
Vulnerability Description
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-1252
Credits & Attribution
No credits recorded in the NVD database.
References
- https://usn.ubuntu.com/777-1/
- http://secunia.com/advisories/35137
- http://secunia.com/advisories/35166
- http://secunia.com/advisories/37470
- http://secunia.com/advisories/35388
- http://secunia.com/advisories/35243
- http://secunia.com/advisories/37471
- http://www.debian.org/security/2009/dsa-1801
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html
- http://secunia.com/advisories/35308
- http://secunia.com/advisories/35253
- https://support.ntp.org/bugs/show_bug.cgi?id=1151
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:117
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0092
- http://www.securitytracker.com/id?1022243
- http://secunia.com/advisories/35138
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238
- https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
- https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00293.html
- http://secunia.com/advisories/35630
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- https://launchpad.net/bugs/cve/2009-1252
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11231
- https://bugzilla.redhat.com/show_bug.cgi?id=499694
- http://www.securityfocus.com/bid/35017
- http://rhn.redhat.com/errata/RHSA-2009-1040.html
- http://security.freebsd.org/advisories/FreeBSD-SA-09:11.ntpd.asc
- http://secunia.com/advisories/35416
- http://www.kb.cert.org/vuls/id/853097
- http://secunia.com/advisories/35336
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc
- http://rhn.redhat.com/errata/RHSA-2009-1039.html
- http://www.vupen.com/english/advisories/2009/1361
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6307
- http://secunia.com/advisories/35169
- http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml
- http://www.vupen.com/english/advisories/2009/3316
More from ntp
View All →CVE-2020-15025
ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101...
Medium
4.4
CVE-2020-13817
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows...
Medium
5.9
CVE-2020-11868
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows...
Medium
5.9
CVE-2019-11331
Network Time Protocol (NTP), as specified in RFC 5905, uses...
High
8.1
CVE-2018-8956
ntpd in ntp 4.2.8p10, 4.2.8p11, 4.2.8p12 and 4.2.8p13 allow remote...
Medium
5.3
Affected Vendor
Affected Software
ntp
Vulnerable Versions:
4.2.4p0, 4.2.4p1, 4.2.4p2, 4.2.4p3, 4.2.4p4, 4.2.4p5, 4.2.4p6, 4.2.5p0, 4.2.5p1, 4.2.5p2, 4.2.5p3, 4.2.5p4, 4.2.5p5, 4.2.5p6, 4.2.5p7, 4.2.5p8, 4.2.5p9, 4.2.5p10, 4.2.5p11, 4.2.5p12, 4.2.5p13, 4.2.5p14, 4.2.5p15, 4.2.5p16, 4.2.5p17, 4.2.5p18, 4.2.5p19, 4.2.5p20, 4.2.5p21, 4.2.5p23, 4.2.5p24, 4.2.5p25, 4.2.5p26, 4.2.5p27, 4.2.5p28, 4.2.5p29, 4.2.5p30, 4.2.5p31, 4.2.5p32, 4.2.5p33, 4.2.5p35, 4.2.5p36, 4.2.5p37, 4.2.5p38, 4.2.5p39, 4.2.5p40, 4.2.5p41, 4.2.5p42, 4.2.5p43, 4.2.5p44, 4.2.5p45, 4.2.5p46, 4.2.5p47, 4.2.5p48, 4.2.5p49, 4.2.5p50, 4.2.5p51, 4.2.5p52, 4.2.5p53, 4.2.5p54, 4.2.5p55, 4.2.5p56, 4.2.5p57, 4.2.5p58, 4.2.5p59, 4.2.5p60, 4.2.5p61, 4.2.5p62, 4.2.5p63, 4.2.5p64, 4.2.5p65, 4.2.5p66, 4.2.5p67, 4.2.5p68, 4.2.5p69, 4.2.5p70, 4.2.5p71, 4.2.5p73
Timeline
Official Publish:
May 19th, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.