Unrated severityNVD Advisory· Published May 19, 2009· Updated Apr 23, 2026
CVE-2009-1252
CVE-2009-1252
Description
Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.
Affected products
78cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*+ 77 more
- cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p0:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p1:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p10:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p11:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p12:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p13:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p14:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p15:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p16:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p17:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p18:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p19:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p2:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p20:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p21:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p23:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p24:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p25:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p26:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p27:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p28:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p29:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p3:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p30:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p31:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p32:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p33:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p35:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p36:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p37:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p38:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p39:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p4:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p40:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p41:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p42:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p43:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p44:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p45:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p46:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p47:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p48:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p49:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p5:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p50:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p51:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p52:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p53:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p54:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p55:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p56:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p57:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p58:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p59:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p6:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p60:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p61:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p62:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p63:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p64:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p65:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p66:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p67:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p68:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p69:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p7:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p70:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p71:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p73:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p8:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5p9:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
39- rhn.redhat.com/errata/RHSA-2009-1039.htmlnvdPatch
- rhn.redhat.com/errata/RHSA-2009-1040.htmlnvdPatch
- bugzilla.redhat.com/show_bug.cginvdPatch
- www.kb.cert.org/vuls/id/853097nvdUS Government Resource
- ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.ascnvd
- lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.htmlnvd
- secunia.com/advisories/35137nvd
- secunia.com/advisories/35138nvd
- secunia.com/advisories/35166nvd
- secunia.com/advisories/35169nvd
- secunia.com/advisories/35243nvd
- secunia.com/advisories/35253nvd
- secunia.com/advisories/35308nvd
- secunia.com/advisories/35336nvd
- secunia.com/advisories/35388nvd
- secunia.com/advisories/35416nvd
- secunia.com/advisories/35630nvd
- secunia.com/advisories/37470nvd
- secunia.com/advisories/37471nvd
- security.freebsd.org/advisories/FreeBSD-SA-09:11.ntpd.ascnvd
- slackware.com/security/viewer.phpnvd
- wiki.rpath.com/wiki/Advisories:rPSA-2009-0092nvd
- www.debian.org/security/2009/dsa-1801nvd
- www.gentoo.org/security/en/glsa/glsa-200905-08.xmlnvd
- www.mandriva.com/security/advisoriesnvd
- www.securityfocus.com/archive/1/507985/100/0/threadednvd
- www.securityfocus.com/bid/35017nvd
- www.securitytracker.com/idnvd
- www.vmware.com/security/advisories/VMSA-2009-0016.htmlnvd
- www.vupen.com/english/advisories/2009/1361nvd
- www.vupen.com/english/advisories/2009/3316nvd
- launchpad.net/bugs/cve/2009-1252nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11231nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6307nvd
- support.ntp.org/bugs/show_bug.cginvd
- usn.ubuntu.com/777-1/nvd
- www.redhat.com/archives/fedora-package-announce/2009-June/msg00293.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.htmlnvd
News mentions
0No linked articles in our index yet.