CVE-2009-3563

Description

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

6.4

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 83.12% Top 5%

Vendor Advisory redhat.com Vendor Advisory marc.info Vendor Advisory ibm.com Vendor Advisory debian.org Vendor Advisory marc.info Vendor Advisory sun.com Vendor Advisory ibm.com Vendor Advisory netbsd.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com

Affected: n/a n/a

References

Link	Tags
http://www.kb.cert.org/vuls/id/568372	us government resource third party advisory patch
http://secunia.com/advisories/38832	third party advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11225	vdb entry signature
http://support.avaya.com/css/P8/documents/100071808
http://secunia.com/advisories/38794	third party advisory
http://lists.vmware.com/pipermail/security-announce/2010/000082.html	mailing list
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00809.html	vendor advisory
https://bugzilla.redhat.com/show_bug.cgi?id=531213
http://secunia.com/advisories/38764	third party advisory
http://support.ntp.org/bin/view/Main/SecurityNotice#DoS_attack_from_certain_NTP_mode	patch
http://www.kb.cert.org/vuls/id/MAPG-7X7V6J
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19376	vdb entry signature
http://www.securityfocus.com/bid/37255	vdb entry patch
http://marc.info/?l=bugtraq&m=136482797910018&w=2	vendor advisory
http://secunia.com/advisories/39593	third party advisory
http://www-01.ibm.com/support/docview.wss?uid=isg1IZ71047	vendor advisory
http://www.vupen.com/english/advisories/2010/0993	vdb entry
http://www.debian.org/security/2009/dsa-1948	patch vendor advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560074
http://aix.software.ibm.com/aix/efixes/security/xntpd_advisory.asc
http://marc.info/?l=bugtraq&m=130168580504508&w=2	vendor advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021781.1-1	vendor advisory
http://www-01.ibm.com/support/docview.wss?uid=isg1IZ68659	vendor advisory
https://support.ntp.org/bugs/show_bug.cgi?id=1331
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7076	vdb entry signature
http://secunia.com/advisories/37922	third party advisory
ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-005.txt.asc	vendor advisory
http://secunia.com/advisories/38834	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00763.html	vendor advisory
http://security-tracker.debian.org/tracker/CVE-2009-3563
http://securitytracker.com/id?1023298	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12141	vdb entry signature
https://rhn.redhat.com/errata/RHSA-2009-1651.html	vendor advisory
http://secunia.com/advisories/37629	third party advisory
https://rhn.redhat.com/errata/RHSA-2010-0095.html	vendor advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
https://lists.ntp.org/pipermail/announce/2009-December/000086.html	mailing list
http://www.vupen.com/english/advisories/2010/0510	vdb entry
https://rhn.redhat.com/errata/RHSA-2009-1648.html	vendor advisory
http://www.kb.cert.org/vuls/id/MAPG-7X7VD7
http://www.vupen.com/english/advisories/2010/0528	vdb entry
https://www.kb.cert.org/vuls/id/417980	third party advisory

Frequently Asked Questions

What is the severity of CVE-2009-3563?: CVE-2009-3563 has been scored as a medium severity vulnerability.
How to fix CVE-2009-3563?: To fix CVE-2009-3563, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-3563 being actively exploited in the wild?: It is possible that CVE-2009-3563 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~83% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.