Read the docs
TI-2001-00407 Aliases CVE-2001-0414GHSA-xj76-gxv6-j253

Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows…

Priority CRITICAL 86Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Buffer overflow in ntpd ntp daemon 4.0.99k and earlier (aka xntpd and xntp3) allows remote attackers to cause a denial of service and possibly execute arbitrary commands via a long readvar argument.

Why it matters now

EPSS 0.91945 99th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:dave_mills:ntpd:*:*:*:*:*:*:*:*up to 4.0.99kVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99:*:*:*:*:*:*:*4.0.99VulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99a:*:*:*:*:*:*:*4.0.99aVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99b:*:*:*:*:*:*:*4.0.99bVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99c:*:*:*:*:*:*:*4.0.99cVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99d:*:*:*:*:*:*:*4.0.99dVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99e:*:*:*:*:*:*:*4.0.99eVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99f:*:*:*:*:*:*:*4.0.99fVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99g:*:*:*:*:*:*:*4.0.99gVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99h:*:*:*:*:*:*:*4.0.99hVulnerableDave Mills
  • cpe:2.3:a:dave_mills:ntpd:*:*:*:*:*:*:*:* Versions up to 4.0.99k Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99:*:*:*:*:*:*:* Versions 4.0.99 Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99a:*:*:*:*:*:*:* Versions 4.0.99a Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99b:*:*:*:*:*:*:* Versions 4.0.99b Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99c:*:*:*:*:*:*:* Versions 4.0.99c Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99d:*:*:*:*:*:*:* Versions 4.0.99d Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99e:*:*:*:*:*:*:* Versions 4.0.99e Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99f:*:*:*:*:*:*:* Versions 4.0.99f Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99g:*:*:*:*:*:*:* Versions 4.0.99g Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99h:*:*:*:*:*:*:* Versions 4.0.99h Vulnerable ·Dave Mills
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:dave_mills:ntpd:4.0.99i:*:*:*:*:*:*:*4.0.99iVulnerableDave Mills
cpe:2.3:a:dave_mills:ntpd:4.0.99j:*:*:*:*:*:*:*4.0.99jVulnerableDave Mills
cpe:2.3:a:dave_mills:xntp3:5.93:*:*:*:*:*:*:*5.93VulnerableDave Mills
cpe:2.3:a:dave_mills:xntp3:5.93a:*:*:*:*:*:*:*5.93aVulnerableDave Mills
cpe:2.3:a:dave_mills:xntp3:5.93b:*:*:*:*:*:*:*5.93bVulnerableDave Mills
cpe:2.3:a:dave_mills:xntp3:5.93c:*:*:*:*:*:*:*5.93cVulnerableDave Mills
cpe:2.3:a:dave_mills:xntp3:5.93d:*:*:*:*:*:*:*5.93dVulnerableDave Mills
cpe:2.3:a:dave_mills:xntp3:5.93e:*:*:*:*:*:*:*5.93eVulnerableDave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99i:*:*:*:*:*:*:* Versions 4.0.99i Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:ntpd:4.0.99j:*:*:*:*:*:*:* Versions 4.0.99j Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:xntp3:5.93:*:*:*:*:*:*:* Versions 5.93 Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:xntp3:5.93a:*:*:*:*:*:*:* Versions 5.93a Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:xntp3:5.93b:*:*:*:*:*:*:* Versions 5.93b Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:xntp3:5.93c:*:*:*:*:*:*:* Versions 5.93c Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:xntp3:5.93d:*:*:*:*:*:*:* Versions 5.93d Vulnerable ·Dave Mills
  • cpe:2.3:a:dave_mills:xntp3:5.93e:*:*:*:*:*:*:* Versions 5.93e Vulnerable ·Dave Mills

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Linux 5.2Fixed RHSA-2001:045
Red Hat Linux 6.2Fixed RHSA-2001:045
Red Hat Linux 7.0Fixed RHSA-2001:045

Timeline

  1. 2026-10-02 Threatist record created from CVE-2001-0414
  2. 2026-10-03 Alias added: GHSA-xj76-gxv6-j253

References

Patch 1

Advisory 5

Other 12

  • TI-2005-02363 The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string… CVSS 2.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences