ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ntp | Dec 1, 2016 | Dec 9, 2009 |
| Debian | — | Upgrade ntp | Jul 30, 2024 | Dec 9, 2009 |
| F5 Big Ip | — | — | Nov 14, 2016 | Dec 9, 2009 |
| Gentoo Linux | — | Upgrade net-misc/ntp. | Oct 30, 2017 | Dec 9, 2009 |
| Hpux | — | Update NTP.NTP-RUN to the latest versionUpdate NTP.NTP-AUX to the latest versionUpdate NTP.INETSVCS2-BOOT to the latest versionApply patch PHNE_42470 from HP | Aug 11, 2017 | Dec 9, 2009 |
| Ibm Aix | — | Apply the fix or workaround for xntpd_advisory | Nov 30, 2017 | Dec 9, 2009 |
| Ntp | — | Upgrade to the latest version of NTP | Feb 23, 2023 | Dec 9, 2009 |
| Oracle_linux | — | Upgrade ntp | Oct 16, 2024 | Dec 9, 2009 |
| Suse | — | Upgrade ntpUpgrade sap-aio-releaseUpgrade xntp-docUpgrade ntp-docUpgrade xntp | Feb 17, 2015 | Dec 9, 2009 |
| Ubuntu | — | Upgrade ntpUpgrade ntp-server | Nov 8, 2024 | Dec 9, 2009 |
| Vmsa 2010 0004 2 Vma And Service Console Package Ntp | — | Upgrade VMware ESX 4.0 to build number 236512Upgrade VMware ESX 3.5 to build number 259926 | Aug 31, 2010 | Dec 9, 2009 |
| Vmsa 2010 0009 1 Esxi Userworld Update | — | Upgrade VMware ESXi 3.5 to build number 259926Upgrade VMware ESXi 4.0 to build number 256968 | Sep 2, 2010 | Dec 9, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub