Read the docs
TI-2009-00021 Aliases CVE-2009-0021GHSA-4q4m-qx69-vcgq

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return…

Priority LOW 29CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · None · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-287.

Summary

NTP 4.2.4 before 4.2.4p5 and 4.2.5 before 4.2.5p150 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.

Why it matters now

EPSS 0.03218 88th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*up to 4.2.4p4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*4.2.4p1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*4.2.4p2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*4.2.4p3VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* Versions up to 4.2.4p4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:* Versions 4.2.4p1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:* Versions 4.2.4p2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:* Versions 4.2.4p3 Vulnerable ·NTP Project

Remediation

Red Hat 1 advisory

  • RHSA-2009:0046 Released 2009-01-29 · Red Hat rating Moderate
    ntp security update
    • Red Hat Enterprise Linux (v. 5 server) ntp-4.2.2p1-9.el5_3.1, ntp-4.2.2p1-9.el5_3.1.i386, ntp-4.2.2p1-9.el5_3.1.ia64 +1
    • Red Hat Enterprise Linux AS version 4 ntp-4.2.0.a.20040617-8.el4_7.1, ntp-4.2.0.a.20040617-8.el4_7.1.i386, ntp-4.2.0.a.20040617-8.el4_7.1.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) ntp-4.2.2p1-9.el5_3.1, ntp-4.2.2p1-9.el5_3.1.i386
    • Red Hat Enterprise Linux Desktop version 4 ntp-4.2.0.a.20040617-8.el4_7.1, ntp-4.2.0.a.20040617-8.el4_7.1.i386
    • Red Hat Enterprise Linux ES version 4 ntp-4.2.0.a.20040617-8.el4_7.1, ntp-4.2.0.a.20040617-8.el4_7.1.i386, ntp-4.2.0.a.20040617-8.el4_7.1.ia64
    • Red Hat Enterprise Linux WS version 4 ntp-4.2.0.a.20040617-8.el4_7.1, ntp-4.2.0.a.20040617-8.el4_7.1.i386, ntp-4.2.0.a.20040617-8.el4_7.1.ia64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:0046
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:0046
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:0046
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:0046
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:0046
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:0046

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0021
  2. 2026-10-03 Alias added: GHSA-4q4m-qx69-vcgq

References

Advisory 8

Other 4

  • TI-2015-06541 Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows… CVSS 3.1CRITICAL 9.8
  • TI-2014-07543 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers… CVSS 2.0HIGH 7.5
  • TI-2013-04524 The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote… CVSS 2.0MEDIUM 5.0
  • TI-2016-06333 The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a… CVSS 3.1HIGH 7.5
  • TI-2018-08842 Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker… CVSS 3.0CRITICAL 9.8
  • TI-2016-04280 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon… CVSS 3.1HIGH 7.5
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences