CVE-2009-3563
CVE-2009-3563 is a medium-severity vulnerability in Ntp with a CVSS 2.0 base score of 6.4. Its EPSS exploit-prediction score of 32% places it in the 98th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 6.4)
- EPSS exploit prediction: 32% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Ntp
- Published:
- Last modified:
Description
ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
Frequently asked questions
- What is CVE-2009-3563?
- ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
- How severe is CVE-2009-3563?
- CVE-2009-3563 has a CVSS 2.0 base score of 6.4, rated medium severity.
- Is CVE-2009-3563 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 32% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2009-3563?
- CVE-2009-3563 primarily affects Ntp. In total, 21 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2009-3563?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2009-3563 published?
- CVE-2009-3563 was published on 2009-12-09 and last updated on 2026-06-16.
References
- ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-005.txt.asc
- http://aix.software.ibm.com/aix/efixes/security/xntpd_advisory.asc
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560074
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
- http://lists.vmware.com/pipermail/security-announce/2010/000082.html
- http://marc.info/?l=bugtraq&m=130168580504508&w=2
- http://marc.info/?l=bugtraq&m=136482797910018&w=2
- http://secunia.com/advisories/37629
- http://secunia.com/advisories/37922
- http://secunia.com/advisories/38764
- http://secunia.com/advisories/38794
- http://secunia.com/advisories/38832
- http://secunia.com/advisories/38834
- http://secunia.com/advisories/39593
- http://security-tracker.debian.org/tracker/CVE-2009-3563
- http://securitytracker.com/id?1023298
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021781.1-1
- http://support.avaya.com/css/P8/documents/100071808
- http://support.ntp.org/bin/view/Main/SecurityNotice#DoS_attack_from_certain_NTP_mode
- http://www-01.ibm.com/support/docview.wss?uid=isg1IZ68659
- http://www-01.ibm.com/support/docview.wss?uid=isg1IZ71047
- http://www.debian.org/security/2009/dsa-1948
- http://www.kb.cert.org/vuls/id/568372
- http://www.kb.cert.org/vuls/id/MAPG-7X7V6J
- http://www.kb.cert.org/vuls/id/MAPG-7X7VD7
- http://www.securityfocus.com/bid/37255
- http://www.vupen.com/english/advisories/2010/0510
- http://www.vupen.com/english/advisories/2010/0528
- http://www.vupen.com/english/advisories/2010/0993
Affected products (21)
- cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.72:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.73:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.90:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.91:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.92:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.93:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.94:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.95:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.96:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.97:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.98:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.0.99:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.2p1:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.2p2:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.2p3:*:*:*:*:*:*:*
- cpe:2.3:a:ntp:ntp:4.2.5:*:*:*:*:*:*:*
More vulnerabilities in Ntp
- CVE-2018-12327 — Critical (CVSS 9.8): Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows an attacker to achieve code execution or…
- CVE-2018-7183 — Critical (CVSS 9.8): Buffer overflow in the decodearr function in ntpq in ntp 4.2.8p6 through 4.2.8p10 allows remote attackers to execute…
- CVE-2015-7871 — Critical (CVSS 9.8): Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass…
- CVE-2015-7853 — Critical (CVSS 9.8): The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote…
- CVE-2015-7705 — Critical (CVSS 9.8): The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified…
- CVE-2015-7854 — High (CVSS 8.8): Buffer overflow in the password management functionality in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows…
Threat intelligence
Threat-intel indicators referencing this CVE:
- 42.200.60.186 (ipv4-addr)
- 223.197.153.135 (ipv4-addr)