{"id":"CVE-2009-1252","aliases":["DEBIAN-CVE-2009-1252","DSA-1801-1","EUVD-2009-1251","GHSA-x2p2-g54c-2jqg","RHSA-2009:1039","RHSA-2009:1040","openSUSE-SU-2024:10181-1"],"status":"published","title":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2...","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.21286,"percentile":0.97613,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2009-05-19T00:00:00Z","modified":"2026-08-31T06:47:30Z","fixes":[{"ecosystem":"Debian:11","package":"ntp","fixed_in":["1:4.2.4p6+dfsg-2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.4p6+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.2.p4+dfsg-2etch3"}]}],"versions":["1:4.2.2.p4+dfsg-2","1:4.2.2.p4+dfsg-2etch1","1:4.2.2.p4+dfsg-2etch2"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2.4p4+dfsg-8lenny2"}]}],"versions":["1:4.2.4p4+dfsg-8"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-9.el5_3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-9.el5_3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-9.el5_3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.2p1-9.el5_3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:4.7::as","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:4.7::as","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:4.7::es","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:4.7::es","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"ntp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.0.a.20040617-8.el4_7.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p9-1.1"}]}],"bundled":60}],"products":[{"vendor":"ntp","product":"ntp"}],"references":[{"url":"https://usn.ubuntu.com/777-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://secunia.com/advisories/35137","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35166","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/37470","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35388","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35243","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/37471","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2009/dsa-1801","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/35308","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35253","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://support.ntp.org/bugs/show_bug.cgi?id=1151","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:117","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2009-0016.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0092","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id?1022243","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://secunia.com/advisories/35138","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2009\u0026m=slackware-security.566238","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00293.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/35630","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/archive/1/507985/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://launchpad.net/bugs/cve/2009-1252","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11231","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=499694","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","report"]},{"url":"http://www.securityfocus.com/bid/35017","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2009-1040.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","fix"]},{"url":"http://security.freebsd.org/advisories/FreeBSD-SA-09:11.ntpd.asc","tags":["vendor-advisory","x_refsource_FREEBSD","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/35416","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.kb.cert.org/vuls/id/853097","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource","web"]},{"url":"http://secunia.com/advisories/35336","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc","tags":["vendor-advisory","x_refsource_NETBSD","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2009-1039.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Patch","fix"]},{"url":"http://www.vupen.com/english/advisories/2009/1361","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6307","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://secunia.com/advisories/35169","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2009/3316","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1252","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x2p2-g54c-2jqg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-1252","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1039","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=490617","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1039.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-0159","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-0159","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0159","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-1252","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1252","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1040","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1040.json","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-1252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-5211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5300","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7975","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9311","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2009-1252","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","status":"published","published":"2009-05-19T19:00:00Z","modified":"2024-08-07T05:04:49.3Z","updated_at":"2026-11-02T14:33:25.516454Z"}],"euvd":[{"id":"EUVD-2009-1251","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","status":"published","published":"2009-05-19T19:00:00Z","modified":"2024-08-07T05:04:49Z","updated_at":"2026-11-03T01:39:22.412498Z"}],"ghsa":[{"id":"GHSA-x2p2-g54c-2jqg","title":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2...","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","status":"published","published":"2022-05-03T03:20:25Z","modified":"2023-02-01T05:01:28Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:49:43.819101Z"}],"nvd":[{"id":"CVE-2009-1252","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","status":"published","published":"2009-05-19T19:30:00.67Z","modified":"2026-06-16T23:06:51.997Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:01:35.136779Z"}],"osv":[{"id":"CVE-2009-1252","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","status":"published","published":"2009-05-19T19:30:00Z","modified":"2026-04-10T03:40:42.988681Z","updated_at":"2026-11-02T15:43:57.452479Z"},{"id":"DEBIAN-CVE-2009-1252","description":"Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.","status":"published","published":"2009-05-19T19:30:00.67Z","modified":"2026-08-31T06:47:30.598893211Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1801-1","title":"ntp - several vulnerabilities","status":"published","published":"2009-05-19T00:00:00Z","modified":"2026-03-09T01:18:44.244133Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"openSUSE-SU-2024:10181-1","title":"ntp-4.2.8p9-1.1 on GA media","description":"These are all security issues fixed in the ntp-4.2.8p9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:26.696395Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2009:1039","title":"Red Hat Security Advisory: ntp security update","status":"published","published":"2024-09-15T17:57:45Z","modified":"2026-06-26T10:11:13Z","updated_at":"2026-11-02T15:53:00.468834Z"},{"id":"RHSA-2009:1040","title":"Red Hat Security Advisory: ntp security update","status":"published","published":"2024-09-15T17:57:49Z","modified":"2026-06-26T10:11:14Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}