CVE-2009-1252
Fixed in a distro release EPSS 21%
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
Products: ntp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | ntp | 1:4.2.4p6+dfsg-2 |
| Debian 4.0 | ntp | 1:4.2.2.p4+dfsg-2etch3 |
| Debian 5.0 | ntp | 1:4.2.4p4+dfsg-8lenny2 |
| Red Hat Enterprise Linux 4 | ntp | 0:4.2.0.a.20040617-8.el4_7.2 |
| Red Hat Enterprise Linux 4 | ntp-debuginfo | 0:4.2.0.a.20040617-8.el4_7.2 |
| Red Hat Enterprise Linux 5 | ntp | 0:4.2.2p1-9.el5_3.2 |
| Red Hat Enterprise Linux 5 | ntp-debuginfo | 0:4.2.2p1-9.el5_3.2 |
| Red Hat rhel eus 4.7 | ntp | 0:4.2.0.a.20040617-8.el4_7.2 |
| Red Hat rhel eus 4.7 | ntp-debuginfo | 0:4.2.0.a.20040617-8.el4_7.2 |
| openSUSE Tumbleweed | ntp | 4.2.8p9-1.1 |