CVE-2009-1252: Ntp

Medium severity, CVSS 6.8. EPSS: 21.3% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the crypto_recv function in ntp_crypto.c in ntpd in NTP before 4.2.4p7 and 4.2.5 before 4.2.5p74, when OpenSSL and autokey are enabled, allows remote attackers to execute arbitrary code via a crafted packet containing an extension field.

Affected products

• Ntp Ntp: version 4.2.4p0 only; version 4.2.4p1 only; version 4.2.4p2 only; version 4.2.4p3 only; version 4.2.4p4 only; version 4.2.4p5 only; …

Published 2009-05-19. Last modified 2026-06-16.