DEBIAN-CVE-2009-1252

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2009-1252

Import Source

https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1252.json

JSON Data

https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2009-1252

Upstream

CVE-2009-1252

Downstream

DSA-1801-1

Published

2009-05-19T19:30:00Z

Modified

2026-08-06T06:47:48Z

Summary

[none]

Details

Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.

References

https://security-tracker.debian.org/tracker/CVE-2009-1252

Affected packages

Debian:11 / ntp

Package

Name: ntp
Purl: pkg:deb/debian/ntp?arch=source&distro=bullseye

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1:4.2.4p6+dfsg-2

Ecosystem specific

{
    "urgency": "high"
}

Database specific

source

"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2009-1252.json"