CVE-2009-1252
N/A
Published: May 19, 2009 at 07:00 PM UTC
Updated: June 16, 2026 at 11:06 PM UTC
1 product affected across 1 vendorNTP
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 21%
Description
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
4.2.4p04.2.4p14.2.4p24.2.4p34.2.4p44.2.4p54.2.4p64.2.5p04.2.5p14.2.5p104.2.5p114.2.5p124.2.5p134.2.5p144.2.5p154.2.5p164.2.5p174.2.5p184.2.5p194.2.5p24.2.5p204.2.5p214.2.5p234.2.5p244.2.5p254.2.5p264.2.5p274.2.5p284.2.5p294.2.5p34.2.5p304.2.5p314.2.5p324.2.5p334.2.5p354.2.5p364.2.5p374.2.5p384.2.5p394.2.5p44.2.5p404.2.5p414.2.5p424.2.5p434.2.5p444.2.5p454.2.5p464.2.5p474.2.5p484.2.5p494.2.5p54.2.5p504.2.5p514.2.5p524.2.5p534.2.5p544.2.5p554.2.5p564.2.5p574.2.5p584.2.5p594.2.5p64.2.5p604.2.5p614.2.5p624.2.5p634.2.5p644.2.5p654.2.5p664.2.5p674.2.5p684.2.5p694.2.5p74.2.5p704.2.5p714.2.5p734.2.5p84.2.5p9
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc
- http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
- http://rhn.redhat.com/errata/RHSA-2009-1039.html
- http://rhn.redhat.com/errata/RHSA-2009-1040.html
- http://security.freebsd.org/advisories/FreeBSD-SA-09:11.ntpd.asc
References (39)
Vendor Advisoryx_refsource_NETBSD
Source: [email protected]
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.ascVendor Advisoryx_refsource_SUSE
Source: [email protected]
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlVendor Advisoryx_refsource_REDHATPatch
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2009-1039.htmlVendor Advisoryx_refsource_REDHATPatch
Source: [email protected]
http://rhn.redhat.com/errata/RHSA-2009-1040.htmlQuick Info
StatusMODIFIED
CWE
CWE-119
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card