Read the docs
TI-2009-03400 Aliases CVE-2009-3563GHSA-gm22-x89c-4h54

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause…

Priority MEDIUM 53Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

Why it matters now

EPSS 0.32059 98th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*up to 4.2.2p4VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*4.0.72VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*4.0.73VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*4.0.90VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*4.0.91VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*4.0.92VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*4.0.93VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*4.0.94VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*4.0.95VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*4.0.96VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:* Versions up to 4.2.2p4 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:* Versions 4.0.72 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:* Versions 4.0.73 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:* Versions 4.0.90 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:* Versions 4.0.91 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:* Versions 4.0.92 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:* Versions 4.0.93 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:* Versions 4.0.94 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:* Versions 4.0.95 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:* Versions 4.0.96 Vulnerable ·NTP Project
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*4.0.97VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*4.0.98VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*4.0.99VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*4.2.2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*4.2.2p1VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*4.2.2p2VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*4.2.2p3VulnerableNTP Project
cpe:2.3:a:ntp:ntp:4.2.5:*:*:*:*:*:*:*4.2.5VulnerableNTP Project
  • cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:* Versions 4.0.97 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:* Versions 4.0.98 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:* Versions 4.0.99 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:* Versions 4.2.2p1 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:* Versions 4.2.2p2 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:* Versions 4.2.2p3 Vulnerable ·NTP Project
  • cpe:2.3:a:ntp:ntp:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Vulnerable ·NTP Project

Remediation

Red Hat 2 advisories

  • RHSA-2009:1651 Released 2009-12-08 · Red Hat rating Moderate
    ntp security update
    • Red Hat Desktop version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386
    • Red Hat Enterprise Linux AS version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386, ntp-4.1.2-6.el3.ia64 +1
    • Red Hat Enterprise Linux ES version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386, ntp-4.1.2-6.el3.ia64
    • Red Hat Enterprise Linux WS version 3 ntp-4.1.2-6.el3, ntp-4.1.2-6.el3.i386, ntp-4.1.2-6.el3.ia64
  • RHSA-2009:1648 Released 2009-12-08 · Red Hat rating Moderate
    ntp security update
    • Red Hat Enterprise Linux (v. 5 server) ntp-4.2.2p1-9.el5_4.1, ntp-4.2.2p1-9.el5_4.1.i386, ntp-4.2.2p1-9.el5_4.1.ia64 +1
    • Red Hat Enterprise Linux AS version 4 ntp-4.2.0.a.20040617-8.el4_8.1, ntp-4.2.0.a.20040617-8.el4_8.1.i386, ntp-4.2.0.a.20040617-8.el4_8.1.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 5 client) ntp-4.2.2p1-9.el5_4.1, ntp-4.2.2p1-9.el5_4.1.i386
    • Red Hat Enterprise Linux Desktop version 4 ntp-4.2.0.a.20040617-8.el4_8.1, ntp-4.2.0.a.20040617-8.el4_8.1.i386
    • Red Hat Enterprise Linux ES version 4 ntp-4.2.0.a.20040617-8.el4_8.1, ntp-4.2.0.a.20040617-8.el4_8.1.i386, ntp-4.2.0.a.20040617-8.el4_8.1.ia64
    • Red Hat Enterprise Linux WS version 4 ntp-4.2.0.a.20040617-8.el4_8.1, ntp-4.2.0.a.20040617-8.el4_8.1.i386, ntp-4.2.0.a.20040617-8.el4_8.1.ia64

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Desktop version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2009:1648
Red Hat Enterprise Linux AS version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux AS version 4Fixed RHSA-2009:1648
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2009:1648
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2009:1648
Red Hat Enterprise Linux ES version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux ES version 4Fixed RHSA-2009:1648
Red Hat Enterprise Linux WS version 3Fixed RHSA-2009:1651
Red Hat Enterprise Linux WS version 4Fixed RHSA-2009:1648

Timeline

  1. 2026-10-02 Threatist record created from CVE-2009-3563
  2. 2026-10-03 Alias added: GHSA-gm22-x89c-4h54

References

Patch 3

Advisory 11

Other 19

  • TI-2015-06541 Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows… CVSS 3.1CRITICAL 9.8
  • TI-2014-07543 Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers… CVSS 2.0HIGH 7.5
  • TI-2013-04524 The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote… CVSS 2.0MEDIUM 5.0
  • TI-2016-06333 The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a… CVSS 3.1HIGH 7.5
  • TI-2018-08842 Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker… CVSS 3.0CRITICAL 9.8
  • TI-2016-04280 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon… CVSS 3.1HIGH 7.5
See all 98 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences