CVE-2009-3563
Fixed in a distro release EPSS 32%
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
Products: ntp
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | ntp | 1:4.2.4p8+dfsg-1 |
| Debian 4.0 | ntp | 1:4.2.2.p4+dfsg-2etch4 |
| Debian 5.0 | ntp | 1:4.2.4p4+dfsg-8lenny3 |
| Red Hat Enterprise Linux 3 | ntp | 0:4.1.2-6.el3 |
| Red Hat Enterprise Linux 3 | ntp-debuginfo | 0:4.1.2-6.el3 |
| Red Hat Enterprise Linux 4 | ntp | 0:4.2.0.a.20040617-8.el4_8.1 |
| Red Hat Enterprise Linux 4 | ntp-debuginfo | 0:4.2.0.a.20040617-8.el4_8.1 |
| Red Hat Enterprise Linux 5 | ntp | 0:4.2.2p1-9.el5_4.1 |
| Red Hat Enterprise Linux 5 | ntp-debuginfo | 0:4.2.2p1-9.el5_4.1 |