Description
Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | ntp | 1:4.2.4p6+dfsg-2 | — |
| Debian 5.0 | ntp | 1:4.2.4p4+dfsg-8lenny2 | DSA-1801-1 |
| Debian 4.0 | ntp | 1:4.2.2.p4+dfsg-2etch3 | DSA-1801-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ntp | 4.2.2p1-9.el5_3.2 | RHSA-2009:1039 |
| RHEL 4 | ntp | 4.2.0.a.20040617-8.el4_7.2 | RHSA-2009:1040 |
| RHEL 3 | ntp | 4.1.2-6.el3 | RHSA-2009:1651 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4.7 EUS | ntp | 4.2.0.a.20040617-8.el4_7.2 | RHSA-2009:1040 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ntp | 4.2.8p9-1.1 | openSUSE-SU-2024:10181-1 |
Advisories 5
- RHSA-2009:1651 Red Hat Security Advisory: ntp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1040 Red Hat Security Advisory: ntp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1039 Red Hat Security Advisory: ntp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1801-1 ntp - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10181-1 ntp-4.2.8p9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-777-1 vendor-advisory
- oval:org.mitre.oval:def:9634 vdb-entry signature
- 35137 third-party-advisory
- 34608 third-party-advisory
- 35166 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=490617
- http://support.apple.com/kb/HT3549
- 37471 third-party-advisory
- DSA-1801 vendor-advisory
- FEDORA-2009-5275 vendor-advisory
- 35308 third-party-advisory
- http://bugs.pardus.org.tr/show_bug.cgi?id=9532
- 35253 third-party-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- 35074 third-party-advisory
- 34481 vdb-entry
- 35138 third-party-advisory
- APPLE-SA-2009-05-12 vendor-advisory
- oval:org.mitre.oval:def:8386 vdb-entry signature
- SSA:2009-154-01 vendor-advisory
- SSRT101144 vendor-advisory
- FEDORA-2009-5273 vendor-advisory
- SUSE-SR:2009:011 vendor-advisory
- oval:org.mitre.oval:def:19392 vdb-entry signature
- 35630 third-party-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- ntp-cookedprint-bo(49838) vdb-entry
- 53593 vdb-entry
- 1022033 vdb-entry
- oval:org.mitre.oval:def:8665 vdb-entry signature
- TA09-133A third-party-advisory
- RHSA-2009:1651 vendor-advisory
- ADV-2009-1297 vdb-entry
- oval:org.mitre.oval:def:5411 vdb-entry signature
- RHSA-2009:1040 vendor-advisory
- MDVSA-2009:092 vendor-advisory
- 35416 third-party-advisory
- https://support.ntp.org/bugs/show_bug.cgi?id=1144
- 35336 third-party-advisory
- RHSA-2009:1039 vendor-advisory
- 35169 third-party-advisory
- GLSA-200905-08 vendor-advisory
- ADV-2009-0999 vdb-entry
- ADV-2009-3316 vdb-entry
- http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565