CVE-2009-1252: Buffer Overflow
CERT has reported a vulnerability in ntp (VU#853097). If autokey is enabled, a remote attacker can send a carefully crafted packet that can overflow a stack buffer, potentially allowing for the execution of arbitrary code with the privileges of the ntpd process.
This is corrected upstream in versions 4.2.4p7 and 4.2.5p74, and affects ntp 4.2.4 (and possibly earlier). This issue can also be mitigated by ensuring autokey support is not enabled.
By default, Red Hat Enterprise Linux defaults to running ntpd unprivileged with the ntpd user.
This issue has been assigned CVE-2009-1252.
Other sources
Stack-based buffer overflow in the cryptorecv function in ntpcrypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-1252?
CVE-2009-1252 has a high severity rating, as it can lead to buffer overflow and potentially arbitrary code execution.
How do I fix CVE-2009-1252?
To fix CVE-2009-1252, update your NTP to the patched version which addresses the vulnerability.
Which versions of NTP are affected by CVE-2009-1252?
CVE-2009-1252 affects several versions of NTP prior to the specified patched version, particularly those with autokey enabled.
Is CVE-2009-1252 related to remote attacks?
Yes, CVE-2009-1252 allows remote attackers to exploit the vulnerability by sending crafted packets.
What is the potential impact of exploiting CVE-2009-1252?
Exploiting CVE-2009-1252 could result in the execution of arbitrary code with the privileges of the NTP daemon process.