CVE-2009-3563

Published: Dec 9, 2009Modified: Apr 23, 2026

6.4

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Exploitability: 10.0 / Impact: 4.9

Source: NVD

Description

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

Affected (21)

Products: Ntp: Ntp

Ntp

1 product

Ntp

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Ntp Ntp	Up to 4.2.2p4
Ntp Ntp	Version 4.0.72
Ntp Ntp	Version 4.0.73
Ntp Ntp	Version 4.0.90
Ntp Ntp	Version 4.0.91
Ntp Ntp	Version 4.0.92
Ntp Ntp	Version 4.0.93
Ntp Ntp	Version 4.0.94
Ntp Ntp	Version 4.0.95
Ntp Ntp	Version 4.0.96
Ntp Ntp	Version 4.0.97
Ntp Ntp	Version 4.0.98
Ntp Ntp	Version 4.0.99
Ntp Ntp	Version 4.1.0
Ntp Ntp	Version 4.1.2
Ntp Ntp	Version 4.2.0
Ntp Ntp	Version 4.2.2
Ntp Ntp	Version 4.2.2p1
Ntp Ntp	Version 4.2.2p2
Ntp Ntp	Version 4.2.2p3
Ntp Ntp	Version 4.2.5

References (86)

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-005.txt.asc (unsafe URL)

Source: cve@mitre.org

http://aix.software.ibm.com/aix/efixes/security/xntpd_advisory.asc

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560074

Source: cve@mitre.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673

Source: cve@mitre.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691

Source: cve@mitre.org

http://lists.vmware.com/pipermail/security-announce/2010/000082.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=130168580504508&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=136482797910018&w=2

Source: cve@mitre.org

http://secunia.com/advisories/37629

Source: cve@mitre.org

http://secunia.com/advisories/37922

Source: cve@mitre.org

http://secunia.com/advisories/38764

Source: cve@mitre.org

http://secunia.com/advisories/38794

Source: cve@mitre.org

http://secunia.com/advisories/38832

Source: cve@mitre.org

http://secunia.com/advisories/38834

Source: cve@mitre.org

http://secunia.com/advisories/39593

Source: cve@mitre.org

http://security-tracker.debian.org/tracker/CVE-2009-3563

Source: cve@mitre.org

http://securitytracker.com/id?1023298

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021781.1-1

Source: cve@mitre.org

http://support.avaya.com/css/P8/documents/100071808

Source: cve@mitre.org

http://support.ntp.org/bin/view/Main/SecurityNotice#DoS_attack_from_certain_NTP_mode

Source: cve@mitre.org

Patch

http://www-01.ibm.com/support/docview.wss?uid=isg1IZ68659

Source: cve@mitre.org

http://www-01.ibm.com/support/docview.wss?uid=isg1IZ71047

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1948

Source: cve@mitre.org

Patch

http://www.kb.cert.org/vuls/id/568372

Source: cve@mitre.org

PatchUS Government Resource

http://www.kb.cert.org/vuls/id/MAPG-7X7V6J

Source: cve@mitre.org

http://www.kb.cert.org/vuls/id/MAPG-7X7VD7

Source: cve@mitre.org

http://www.securityfocus.com/bid/37255

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2010/0510

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/0528

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2010/0993

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=531213

Source: cve@mitre.org

https://lists.ntp.org/pipermail/announce/2009-December/000086.html

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11225

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12141

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19376

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7076

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1648.html

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2009-1651.html

Source: cve@mitre.org

https://rhn.redhat.com/errata/RHSA-2010-0095.html

Source: cve@mitre.org

https://support.ntp.org/bugs/show_bug.cgi?id=1331

Source: cve@mitre.org

https://www.kb.cert.org/vuls/id/417980

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00763.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00809.html

Source: cve@mitre.org

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-005.txt.asc (unsafe URL)