Description
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | ntp | 1:4.2.4p6+dfsg-2 | — |
| Debian 5.0 | ntp | 1:4.2.4p4+dfsg-8lenny2 | DSA-1801-1 |
| Debian 4.0 | ntp | 1:4.2.2.p4+dfsg-2etch3 | DSA-1801-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | ntp | 4.2.2p1-9.el5_3.2 | RHSA-2009:1039 |
| RHEL 4 | ntp | 4.2.0.a.20040617-8.el4_7.2 | RHSA-2009:1040 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4.7 EUS | ntp | 4.2.0.a.20040617-8.el4_7.2 | RHSA-2009:1040 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ntp | 4.2.8p9-1.1 | openSUSE-SU-2024:10181-1 |
Advisories 4
- RHSA-2009:1040 Red Hat Security Advisory: ntp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2009:1039 Red Hat Security Advisory: ntp security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1801-1 ntp - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10181-1 ntp-4.2.8p9-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- USN-777-1 vendor-advisory
- 35137 third-party-advisory
- 35166 third-party-advisory
- 37470 third-party-advisory
- 35388 third-party-advisory
- 35243 third-party-advisory
- 37471 third-party-advisory
- DSA-1801 vendor-advisory
- FEDORA-2009-5275 vendor-advisory
- 35308 third-party-advisory
- 35253 third-party-advisory
- https://support.ntp.org/bugs/show_bug.cgi?id=1151
- MDVSA-2009:117 vendor-advisory
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0092
- 1022243 vdb-entry
- 35138 third-party-advisory
- SSA:2009-154-01 vendor-advisory
- FEDORA-2009-5273 vendor-advisory
- SUSE-SR:2009:011 vendor-advisory
- FEDORA-2009-5674 vendor-advisory
- 35630 third-party-advisory
- 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components mailing-list
- https://launchpad.net/bugs/cve/2009-1252
- oval:org.mitre.oval:def:11231 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=499694
- 35017 vdb-entry
- RHSA-2009:1040 vendor-advisory
- FreeBSD-SA-09:11 vendor-advisory
- 35416 third-party-advisory
- VU#853097 third-party-advisory
- 35336 third-party-advisory
- RHSA-2009:1039 vendor-advisory
- ADV-2009-1361 vdb-entry
- oval:org.mitre.oval:def:6307 vdb-entry signature
- 35169 third-party-advisory
- GLSA-200905-08 vendor-advisory
- ADV-2009-3316 vdb-entry