Read the docs
TI-2009-00148 Aliases CVE-2009-0159GHSA-wg77-pm57-j6rv

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP…

Priority MEDIUM 45CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Why it matters now

EPSS 0.13228 96th percentileScored 2026-11-07
Fix Fixed Red Hat: 3 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:*:rc1:*:*:*:*:*:*up to 4.2.4p7VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*4.0.72VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*4.0.73VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*4.0.90VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*4.0.91VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*4.0.92VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*4.0.93VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*4.0.94VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*4.0.95VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*4.0.96VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:*:rc1:*:*:*:*:*:* Versions up to 4.2.4p7 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:* Versions 4.0.72 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:* Versions 4.0.73 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:* Versions 4.0.90 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:* Versions 4.0.91 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:* Versions 4.0.92 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:* Versions 4.0.93 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:* Versions 4.0.94 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:* Versions 4.0.95 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:* Versions 4.0.96 Vulnerable ·NTP Project
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*4.0.97VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*4.0.98VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*4.0.99VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*4.2.2p1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*4.2.2p2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*4.2.2p3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p4:*:*:*:*:*:*:*4.2.2p4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4:*:*:*:*:*:*:*4.2.4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*4.2.4p0VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*4.2.4p1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*4.2.4p2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*4.2.4p3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:*4.2.4p4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:*4.2.4p5VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:*4.2.4p6VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:* Versions 4.0.97 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:* Versions 4.0.98 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:* Versions 4.0.99 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:* Versions 4.2.2p1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:* Versions 4.2.2p2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:* Versions 4.2.2p3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p4:*:*:*:*:*:*:* Versions 4.2.2p4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:* Versions 4.2.4p0 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:* Versions 4.2.4p1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:* Versions 4.2.4p2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:* Versions 4.2.4p3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:* Versions 4.2.4p4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:* Versions 4.2.4p5 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:* Versions 4.2.4p6 Vulnerable ·NTP Project

Remediation

Red Hat 3 advisories

  • RHSA-2009:1651 Released 2009-12-08 · Red Hat rating Moderate
    ntp security update
    • Red Hat Desktop version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386
    • Red Hat Enterprise Linux AS version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386, ntp-4.1.2-6.el3.ia64 +1
    • Red Hat Enterprise Linux ES version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386, ntp-4.1.2-6.el3.ia64
    • Red Hat Enterprise Linux WS version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386, ntp-4.1.2-6.el3.ia64
  • RHSA-2009:1040 Released 2009-05-18 · Red Hat rating Critical
    ntp security update
    • Red Hat Enterprise Linux AS EUS (v. 4.7) ntp-4.2.0.a.20040617-8.el4_7.2, ntp-4.2.0.a.20040617-8.el4_7.2.i386, ntp-4.2.0.a.20040617-8.el4_7.2.ia64 +1
    • Red Hat Enterprise Linux AS version 4 ntp-4.2.0.a.20040617-8.el4_7.2, ntp-4.2.0.a.20040617-8.el4_7.2.i386, ntp-4.2.0.a.20040617-8.el4_7.2.ia64 +1
    • Red Hat Enterprise Linux Desktop version 4 ntp-4.2.0.a.20040617-8.el4_7.2, ntp-4.2.0.a.20040617-8.el4_7.2.i386
    • Red Hat Enterprise Linux ES EUS (v. 4.7) ntp-4.2.0.a.20040617-8.el4_7.2, ntp-4.2.0.a.20040617-8.el4_7.2.i386, ntp-4.2.0.a.20040617-8.el4_7.2.ia64
    • Red Hat Enterprise Linux ES version 4 ntp-4.2.0.a.20040617-8.el4_7.2, ntp-4.2.0.a.20040617-8.el4_7.2.i386, ntp-4.2.0.a.20040617-8.el4_7.2.ia64
    • Red Hat Enterprise Linux WS version 4 ntp-4.2.0.a.20040617-8.el4_7.2, ntp-4.2.0.a.20040617-8.el4_7.2.i386, ntp-4.2.0.a.20040617-8.el4_7.2.ia64
  • RHSA-2009:1039 Released 2009-05-18 · Red Hat rating Important
    ntp security update
    • Red Hat Enterprise Linux (v. 5 server) ntp-4.2.2p1-9.el5_3.2, ntp-4.2.2p1-9.el5_3.2.i386, ntp-4.2.2p1-9.el5_3.2.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) ntp-4.2.2p1-9.el5_3.2, ntp-4.2.2p1-9.el5_3.2.i386

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1039
Red Hat Enterprise Linux AS EUS (v. 4.7)Fixed RHSA-2009:1040
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1040
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1039
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1040
Red Hat Enterprise Linux ES EUS (v. 4.7)Fixed RHSA-2009:1040
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1040
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1040

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-0159
  2. 2026-10-03 Alias added: GHSA-wg77-pm57-j6rv

References

Patch 1

Advisory 17

Other 11

  • TI-2015-06541 Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows… CVSS 3.1CRITICAL 9.8
  • TI-2014-07543 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers… CVSS 2.0HIGH 7.5
  • TI-2013-04524 The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote… CVSS 2.0MEDIUM 5.0
  • TI-2016-06333 The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a… CVSS 3.1HIGH 7.5
  • TI-2018-08842 Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker… CVSS 3.0CRITICAL 9.8
  • TI-2016-04280 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon… CVSS 3.1HIGH 7.5
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences