Strix
26.1K

CVE-2009-3563

UnknownEPSS 32.29%

Last modified

CVE-2009-3563 is a vulnerability of currently unknown severity. ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.. EPSS estimates a 32.29% chance of exploitation in the next 30 days.

Description

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

Metrics

EPSS Probability
32.29%

98.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
NtpNtp<= 4.2.2p4
NtpNtp4.0.72
NtpNtp4.0.73
NtpNtp4.0.90
NtpNtp4.0.91
NtpNtp4.0.92
NtpNtp4.0.93
NtpNtp4.0.94
NtpNtp4.0.95
NtpNtp4.0.96
NtpNtp4.0.97
NtpNtp4.0.98
NtpNtp4.0.99
NtpNtp4.1.0
NtpNtp4.1.2
NtpNtp4.2.0
NtpNtp4.2.2
NtpNtp4.2.2p1
NtpNtp4.2.2p2
NtpNtp4.2.2p3
NtpNtp4.2.5

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2009-3563?
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
How severe is CVE-2009-3563?
Severity scoring for CVE-2009-3563 is pending analysis. The EPSS model estimates a 32.29% probability of exploitation in the next 30 days.
How do I fix CVE-2009-3563?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2009-3563?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST