CVE-2009-0159

Publication date 14 April 2009

Last updated 24 July 2024

Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execute arbitrary code via a crafted response.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
ntp	9.04 jaunty	Fixed 1:4.2.4p4+dfsg-7ubuntu5.1
	8.10 intrepid	Fixed 1:4.2.4p4+dfsg-6ubuntu2.3
	8.04 LTS hardy	Fixed 1:4.2.4p4+dfsg-3ubuntu2.2
	7.10 gutsy	Ignored
	6.06 LTS dapper	Fixed 1:4.2.0a+stable-8.1ubuntu6.2

How can I get the fixes?
What do statuses mean?
Patch details

Notes

kees

user-side (ntpq), 2 bytes, stack-only.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
ntp	Upstream: https://support.ntp.org/bugs/show_bug.cgi?id=1144

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-777-1
Ntp vulnerabilities
19 May 2009

Other references

https://www.cve.org/CVERecord?id=CVE-2009-0159