CVE-2009-0159

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2...

6.8 MediumFix available

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Exploit likelihood

13.2%Up 8.8 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Record: CVE-2009-0159
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Record: CVE-2009-0159
Updated: 2026-11-02

EUVDEUVD-2009-0168 No score

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Record: EUVD-2009-0168
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wg77-pm57-j6rv No score

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2...

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Record: GHSA-wg77-pm57-j6rv
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Record: CVE-2009-0159
Updated: 2026-11-02

OSVDEBIAN-CVE-2009-0159 No score

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Record: DEBIAN-CVE-2009-0159
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10181-1 No score

ntp-4.2.8p9-1.1 on GA media

These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10181-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ntp` Debian:11	before 1:4.2.4p6+dfsg-2	1:4.2.4p6+dfsg-2
`ntp` Debian:4.0 From an advisory covering 2 CVEs	before 1:4.2.2.p4+dfsg-2etch3, plus listed versions 1:4.2.2.p4+dfsg-21:4.2.2.p4+dfsg-2etch11:4.2.2.p4+dfsg-2etch2	1:4.2.2.p4+dfsg-2etch3
`ntp` Debian:5.0 From an advisory covering 2 CVEs	before 1:4.2.4p4+dfsg-8lenny2, plus listed versions 1:4.2.4p4+dfsg-8	1:4.2.4p4+dfsg-8lenny2
`ntp` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:4.2.2p1-9.el5_3.2	0:4.2.2p1-9.el5_3.2
`ntp-debuginfo` Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs	before 0:4.2.2p1-9.el5_3.2	0:4.2.2p1-9.el5_3.2
`ntp` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:4.2.2p1-9.el5_3.2	0:4.2.2p1-9.el5_3.2
`ntp-debuginfo` Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs	before 0:4.2.2p1-9.el5_3.2	0:4.2.2p1-9.el5_3.2
`ntp` Red Hat:rhel_eus:4.7::as From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp-debuginfo` Red Hat:rhel_eus:4.7::as From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2

Show 18 moreShow less

Affected packages
Package	Affected	Fixed
`ntp-debuginfo` Red Hat:enterprise_linux:4::as From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp-debuginfo` Red Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp` Red Hat:rhel_eus:4.7::es From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp-debuginfo` Red Hat:rhel_eus:4.7::es From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp-debuginfo` Red Hat:enterprise_linux:4::es From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp-debuginfo` Red Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs	before 0:4.2.0.a.20040617-8.el4_7.2	0:4.2.0.a.20040617-8.el4_7.2
`ntp` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp-debuginfo` Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp-debuginfo` Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp-debuginfo` Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp-debuginfo` Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs	before 0:4.1.2-6.el3	0:4.1.2-6.el3
`ntp` openSUSE:Tumbleweed From an advisory covering 60 CVEs	before 4.2.8p9-1.1	4.2.8p9-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-0159 is a medium vulnerability (CVSS 6.8) in Ntp, published April 14, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 13.2%, the 96th percentile. Fixed in ntp 1:4.2.4p6+dfsg-2.

References

Show 119 moreShow less