CVEvulnerability

CVE-2009-3563

6.4 MEDIUM Published 2009-12-09 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2009-12-09
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P

Description

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

Affected configurations

• ntp ntp (<= 4.2.2p4) • ntp ntp 4.0.72 • ntp ntp 4.0.73 • ntp ntp 4.0.90 • ntp ntp 4.0.91 • ntp ntp 4.0.92 • ntp ntp 4.0.93 • ntp ntp 4.0.94 • ntp ntp 4.0.95 • ntp ntp 4.0.96 • ntp ntp 4.0.97 • ntp ntp 4.0.98 • ntp ntp 4.0.99 • ntp ntp 4.1.0 • ntp ntp 4.1.2 • ntp ntp 4.2.0 • ntp ntp 4.2.2 • ntp ntp 4.2.2p1 • ntp ntp 4.2.2p2 • ntp ntp 4.2.2p3 • ntp ntp 4.2.5

References