CVE-2009-0159

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.
References
Link Resource
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc
http://bugs.pardus.org.tr/show_bug.cgi?id=9532
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://marc.info/?l=bugtraq&m=136482797910018&w=2
http://marc.info/?l=bugtraq&m=136482797910018&w=2
http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565
http://osvdb.org/53593
http://rhn.redhat.com/errata/RHSA-2009-1039.html
http://rhn.redhat.com/errata/RHSA-2009-1040.html
http://secunia.com/advisories/34608 Vendor Advisory
http://secunia.com/advisories/35074 Vendor Advisory
http://secunia.com/advisories/35137 Vendor Advisory
http://secunia.com/advisories/35138 Vendor Advisory
http://secunia.com/advisories/35166 Vendor Advisory
http://secunia.com/advisories/35169 Vendor Advisory
http://secunia.com/advisories/35253 Vendor Advisory
http://secunia.com/advisories/35308 Vendor Advisory
http://secunia.com/advisories/35336 Vendor Advisory
http://secunia.com/advisories/35416 Vendor Advisory
http://secunia.com/advisories/35630 Vendor Advisory
http://secunia.com/advisories/37471 Vendor Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238
http://support.apple.com/kb/HT3549
http://www.debian.org/security/2009/dsa-1801
http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2009:092
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/34481 Patch
http://www.securitytracker.com/id?1022033
http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/0999 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1297 Vendor Advisory
http://www.vupen.com/english/advisories/2009/3316 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=490617
https://exchange.xforce.ibmcloud.com/vulnerabilities/49838
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634
https://rhn.redhat.com/errata/RHSA-2009-1651.html
https://support.ntp.org/bugs/show_bug.cgi?id=1144 Patch
https://usn.ubuntu.com/777-1/
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc
http://bugs.pardus.org.tr/show_bug.cgi?id=9532
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html
http://marc.info/?l=bugtraq&m=136482797910018&w=2
http://marc.info/?l=bugtraq&m=136482797910018&w=2
http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565
http://osvdb.org/53593
http://rhn.redhat.com/errata/RHSA-2009-1039.html
http://rhn.redhat.com/errata/RHSA-2009-1040.html
http://secunia.com/advisories/34608 Vendor Advisory
http://secunia.com/advisories/35074 Vendor Advisory
http://secunia.com/advisories/35137 Vendor Advisory
http://secunia.com/advisories/35138 Vendor Advisory
http://secunia.com/advisories/35166 Vendor Advisory
http://secunia.com/advisories/35169 Vendor Advisory
http://secunia.com/advisories/35253 Vendor Advisory
http://secunia.com/advisories/35308 Vendor Advisory
http://secunia.com/advisories/35336 Vendor Advisory
http://secunia.com/advisories/35416 Vendor Advisory
http://secunia.com/advisories/35630 Vendor Advisory
http://secunia.com/advisories/37471 Vendor Advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238
http://support.apple.com/kb/HT3549
http://www.debian.org/security/2009/dsa-1801
http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2009:092
http://www.securityfocus.com/archive/1/507985/100/0/threaded
http://www.securityfocus.com/bid/34481 Patch
http://www.securitytracker.com/id?1022033
http://www.us-cert.gov/cas/techalerts/TA09-133A.html US Government Resource
http://www.vmware.com/security/advisories/VMSA-2009-0016.html
http://www.vupen.com/english/advisories/2009/0999 Vendor Advisory
http://www.vupen.com/english/advisories/2009/1297 Vendor Advisory
http://www.vupen.com/english/advisories/2009/3316 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=490617
https://exchange.xforce.ibmcloud.com/vulnerabilities/49838
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634
https://rhn.redhat.com/errata/RHSA-2009-1651.html
https://support.ntp.org/bugs/show_bug.cgi?id=1144 Patch
https://usn.ubuntu.com/777-1/
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ntp:ntp:*:rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.2p4:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p0:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p1:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p2:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p3:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p4:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p5:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.4p6:*:*:*:*:*:*:*

History

21 Nov 2024, 00:59

Type Values Removed Values Added
References () ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc - () ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-006.txt.asc -
References () http://bugs.pardus.org.tr/show_bug.cgi?id=9532 - () http://bugs.pardus.org.tr/show_bug.cgi?id=9532 -
References () http://lists.apple.com/archives/security-announce/2009/May/msg00002.html - () http://lists.apple.com/archives/security-announce/2009/May/msg00002.html -
References () http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html - () http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html -
References () http://marc.info/?l=bugtraq&m=136482797910018&w=2 - () http://marc.info/?l=bugtraq&m=136482797910018&w=2 -
References () http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565 - () http://ntp.bkbits.net:8080/ntp-stable/?PAGE=gnupatch&REV=1.1565 -
References () http://osvdb.org/53593 - () http://osvdb.org/53593 -
References () http://rhn.redhat.com/errata/RHSA-2009-1039.html - () http://rhn.redhat.com/errata/RHSA-2009-1039.html -
References () http://rhn.redhat.com/errata/RHSA-2009-1040.html - () http://rhn.redhat.com/errata/RHSA-2009-1040.html -
References () http://secunia.com/advisories/34608 - Vendor Advisory () http://secunia.com/advisories/34608 - Vendor Advisory
References () http://secunia.com/advisories/35074 - Vendor Advisory () http://secunia.com/advisories/35074 - Vendor Advisory
References () http://secunia.com/advisories/35137 - Vendor Advisory () http://secunia.com/advisories/35137 - Vendor Advisory
References () http://secunia.com/advisories/35138 - Vendor Advisory () http://secunia.com/advisories/35138 - Vendor Advisory
References () http://secunia.com/advisories/35166 - Vendor Advisory () http://secunia.com/advisories/35166 - Vendor Advisory
References () http://secunia.com/advisories/35169 - Vendor Advisory () http://secunia.com/advisories/35169 - Vendor Advisory
References () http://secunia.com/advisories/35253 - Vendor Advisory () http://secunia.com/advisories/35253 - Vendor Advisory
References () http://secunia.com/advisories/35308 - Vendor Advisory () http://secunia.com/advisories/35308 - Vendor Advisory
References () http://secunia.com/advisories/35336 - Vendor Advisory () http://secunia.com/advisories/35336 - Vendor Advisory
References () http://secunia.com/advisories/35416 - Vendor Advisory () http://secunia.com/advisories/35416 - Vendor Advisory
References () http://secunia.com/advisories/35630 - Vendor Advisory () http://secunia.com/advisories/35630 - Vendor Advisory
References () http://secunia.com/advisories/37471 - Vendor Advisory () http://secunia.com/advisories/37471 - Vendor Advisory
References () http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238 - () http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.566238 -
References () http://support.apple.com/kb/HT3549 - () http://support.apple.com/kb/HT3549 -
References () http://www.debian.org/security/2009/dsa-1801 - () http://www.debian.org/security/2009/dsa-1801 -
References () http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml - () http://www.gentoo.org/security/en/glsa/glsa-200905-08.xml -
References () http://www.mandriva.com/security/advisories?name=MDVSA-2009:092 - () http://www.mandriva.com/security/advisories?name=MDVSA-2009:092 -
References () http://www.securityfocus.com/archive/1/507985/100/0/threaded - () http://www.securityfocus.com/archive/1/507985/100/0/threaded -
References () http://www.securityfocus.com/bid/34481 - Patch () http://www.securityfocus.com/bid/34481 - Patch
References () http://www.securitytracker.com/id?1022033 - () http://www.securitytracker.com/id?1022033 -
References () http://www.us-cert.gov/cas/techalerts/TA09-133A.html - US Government Resource () http://www.us-cert.gov/cas/techalerts/TA09-133A.html - US Government Resource
References () http://www.vmware.com/security/advisories/VMSA-2009-0016.html - () http://www.vmware.com/security/advisories/VMSA-2009-0016.html -
References () http://www.vupen.com/english/advisories/2009/0999 - Vendor Advisory () http://www.vupen.com/english/advisories/2009/0999 - Vendor Advisory
References () http://www.vupen.com/english/advisories/2009/1297 - Vendor Advisory () http://www.vupen.com/english/advisories/2009/1297 - Vendor Advisory
References () http://www.vupen.com/english/advisories/2009/3316 - Vendor Advisory () http://www.vupen.com/english/advisories/2009/3316 - Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=490617 - () https://bugzilla.redhat.com/show_bug.cgi?id=490617 -
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/49838 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/49838 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19392 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5411 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8386 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8665 -
References () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634 - () https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9634 -
References () https://rhn.redhat.com/errata/RHSA-2009-1651.html - () https://rhn.redhat.com/errata/RHSA-2009-1651.html -
References () https://support.ntp.org/bugs/show_bug.cgi?id=1144 - Patch () https://support.ntp.org/bugs/show_bug.cgi?id=1144 - Patch
References () https://usn.ubuntu.com/777-1/ - () https://usn.ubuntu.com/777-1/ -
References () https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html - () https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01414.html -
References () https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html - () https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01449.html -

Information

Published : 2009-04-14 15:30

Updated : 2024-11-21 00:59


NVD link : CVE-2009-0159

Mitre link : CVE-2009-0159

CVE.ORG link : CVE-2009-0159


JSON object : View

Products Affected

ntp

  • ntp
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer