ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption…

Exploit prediction (EPSS)

32.06% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

• Metasploit auxiliary/dos/ntp/ntpd_reserved_dos NTP.org ntpd Reserved Mode Denial of Service · metasploit auxiliary, normal rank · 2009-10-04

CVSS scores

References

• kb.cert.org /vuls/id/568372 · third-party-advisory, x_transferred
• secunia.com /advisories/38832 · third-party-advisory, x_transferred
• kb.juniper.net /InfoCenter/index?page=content&id=JSA10673 · x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11225 · vdb-entry, signature, x_transferred
• support.avaya.com /css/P8/documents/100071808 · x_transferred
• secunia.com /advisories/38794 · third-party-advisory, x_transferred
• lists.vmware.com /pipermail/security-announce/2010/000082.html · mailing-list, x_transferred
• redhat.com /archives/fedora-package-announce/2009-December/msg00809.html · vendor-advisory, x_transferred
• bugzilla.redhat.com /show_bug.cgi?id=531213 · x_transferred
• secunia.com /advisories/38764 · third-party-advisory, x_transferred
• support.ntp.org /bin/view/Main/SecurityNotice#DoS_attack_from_certain_NTP_mode · x_transferred
• kb.cert.org /vuls/id/MAPG-7X7V6J · x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19376 · vdb-entry, signature, x_transferred
• securityfocus.com /bid/37255 · vdb-entry, x_transferred
• marc.info /?l=bugtraq&m=136482797910018&w=2 · vendor-advisory, x_transferred
• secunia.com /advisories/39593 · third-party-advisory, x_transferred
• www-01.ibm.com /support/docview.wss?uid=isg1IZ71047 · vendor-advisory, x_transferred
• vupen.com /english/advisories/2010/0993 · vdb-entry, x_transferred
• debian.org /security/2009/dsa-1948 · vendor-advisory, x_transferred
• bugs.debian.org /cgi-bin/bugreport.cgi?bug=560074 · x_transferred
• aix.software.ibm.com /aix/efixes/security/xntpd_advisory.asc · x_transferred
• marc.info /?l=bugtraq&m=130168580504508&w=2 · vendor-advisory, x_transferred
• sunsolve.sun.com /search/document.do?assetkey=1-77-1021781.1-1 · vendor-advisory, x_transferred
• www-01.ibm.com /support/docview.wss?uid=isg1IZ68659 · vendor-advisory, x_transferred
• support.ntp.org /bugs/show_bug.cgi?id=1331 · x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7076 · vdb-entry, signature, x_transferred
• secunia.com /advisories/37922 · third-party-advisory, x_transferred
• secunia.com /advisories/38834 · third-party-advisory, x_transferred
• redhat.com /archives/fedora-package-announce/2009-December/msg00763.html · vendor-advisory, x_transferred
• security-tracker.debian.org /tracker/CVE-2009-3563 · x_transferred
• securitytracker.com /id?1023298 · vdb-entry, x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12141 · vdb-entry, signature, x_transferred
• rhn.redhat.com /errata/RHSA-2009-1651.html · vendor-advisory, x_transferred
• secunia.com /advisories/37629 · third-party-advisory, x_transferred
• rhn.redhat.com /errata/RHSA-2010-0095.html · vendor-advisory, x_transferred
• kb.juniper.net /InfoCenter/index?page=content&id=JSA10691 · x_transferred
• lists.ntp.org /pipermail/announce/2009-December/000086.html · mailing-list, x_transferred
• vupen.com /english/advisories/2010/0510 · vdb-entry, x_transferred
• rhn.redhat.com /errata/RHSA-2009-1648.html · vendor-advisory, x_transferred
• kb.cert.org /vuls/id/MAPG-7X7VD7 · x_transferred
• vupen.com /english/advisories/2010/0528
• kb.cert.org /vuls/id/417980

Sources

• CVE List: CVE-2009-3563
• NVD: CVE-2009-3563

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.