Vulnerability in Ntp
CVE-2009-3563
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
EPSS: 0.313 (98.1th percentile) — read the EPSS interpretation.
Affected products
- Ntp — versions 4.0.72, 4.0.73, 4.0.90
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (US Government Resource, Patch, third-party-advisory)
- cve@mitre.org (third-party-advisory)
- cve@mitre.org
- cve@mitre.org (signature, vdb-entry)
- cve@mitre.org
- cve@mitre.org (third-party-advisory)
- cve@mitre.org (mailing-list)
- cve@mitre.org (vendor-advisory)
- cve@mitre.org
- cve@mitre.org (third-party-advisory)
Frequently asked questions
- What is CVE-2009-3563?
- CVE-2009-3563 is a vulnerability in Ntp. Published 2009-12-09.
- Is CVE-2009-3563 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.