CVE 설명

ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote attackers to cause a denial of service (CPU and bandwidth consumption) by using MODE_PRIVATE to send a spoofed (1) request or (2) response packet that triggers a continuous exchange of MODE_PRIVATE error responses between two NTP daemons.

CVE 정보

메트릭

메트릭	점수	심각도	CVSS 벡터	출처
V2	6.4		AV:N/AC:L/Au:N/C:N/I:P/A:P	nvd@nist.gov

EPSS

EPSS는 취약점이 악용될 가능성을 예측하는 점수 모델입니다.

EPSS 점수

EPSS 모델은 0과 1(0~100%) 사이의 확률 점수를 생성합니다. 점수가 높을수록 취약점이 악용될 가능성이 높습니다.

EPSS 백분위수

백분위수는 EPSS 점수에 따라 CVE의 순위를 매기는 데 사용됩니다. 예를 들어 EPSS 점수 기준 95번째 백분위수의 CVE는 다른 CVE의 95%보다 악용될 가능성이 높습니다.

EPSS First.org

언급된 제품

구성 0

Ntp>>Ntp >> Version 까지 (포함) 4.2.2p4

Ntp>>Ntp >> Version 4.0.72

Ntp>>Ntp >> Version 4.0.73

Ntp>>Ntp >> Version 4.0.90

Ntp>>Ntp >> Version 4.0.91

Ntp>>Ntp >> Version 4.0.92

Ntp>>Ntp >> Version 4.0.93

Ntp>>Ntp >> Version 4.0.94

Ntp>>Ntp >> Version 4.0.95

Ntp>>Ntp >> Version 4.0.96

Ntp>>Ntp >> Version 4.0.97

Ntp>>Ntp >> Version 4.0.98

Ntp>>Ntp >> Version 4.0.99

Ntp>>Ntp >> Version 4.1.0

Ntp>>Ntp >> Version 4.1.2

Ntp>>Ntp >> Version 4.2.0

Ntp>>Ntp >> Version 4.2.2

Ntp>>Ntp >> Version 4.2.2p1

Ntp>>Ntp >> Version 4.2.2p2

Ntp>>Ntp >> Version 4.2.2p3

Ntp>>Ntp >> Version 4.2.5

참고 자료

http://www.kb.cert.org/vuls/id/568372
Tags : third-party-advisory

http://secunia.com/advisories/38832
Tags : third-party-advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11225
Tags : vdb-entry, signature

http://support.avaya.com/css/P8/documents/100071808

http://secunia.com/advisories/38794
Tags : third-party-advisory

http://lists.vmware.com/pipermail/security-announce/2010/000082.html
Tags : mailing-list

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00809.html
Tags : vendor-advisory

https://bugzilla.redhat.com/show_bug.cgi?id=531213

http://secunia.com/advisories/38764
Tags : third-party-advisory

http://support.ntp.org/bin/view/Main/SecurityNotice#DoS_attack_from_certain_NTP_mode
Tags : Patch

http://www.kb.cert.org/vuls/id/MAPG-7X7V6J

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19376
Tags : vdb-entry, signature

http://www.securityfocus.com/bid/37255
Tags : vdb-entry

http://marc.info/?l=bugtraq&m=136482797910018&w=2
Tags : vendor-advisory

http://secunia.com/advisories/39593
Tags : third-party-advisory

http://www-01.ibm.com/support/docview.wss?uid=isg1IZ71047
Tags : vendor-advisory

http://www.vupen.com/english/advisories/2010/0993
Tags : vdb-entry

http://www.debian.org/security/2009/dsa-1948
Tags : vendor-advisory

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=560074

http://aix.software.ibm.com/aix/efixes/security/xntpd_advisory.asc

http://marc.info/?l=bugtraq&m=130168580504508&w=2
Tags : vendor-advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021781.1-1
Tags : vendor-advisory

http://www-01.ibm.com/support/docview.wss?uid=isg1IZ68659
Tags : vendor-advisory

http://marc.info/?l=bugtraq&m=130168580504508&w=2
Tags : vendor-advisory

https://support.ntp.org/bugs/show_bug.cgi?id=1331

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7076
Tags : vdb-entry, signature

http://secunia.com/advisories/37922
Tags : third-party-advisory

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2010-005.txt.asc
Tags : vendor-advisory

http://secunia.com/advisories/38834
Tags : third-party-advisory

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00763.html
Tags : vendor-advisory

http://security-tracker.debian.org/tracker/CVE-2009-3563

http://securitytracker.com/id?1023298
Tags : vdb-entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12141
Tags : vdb-entry, signature

https://rhn.redhat.com/errata/RHSA-2009-1651.html
Tags : vendor-advisory

http://secunia.com/advisories/37629
Tags : third-party-advisory

https://rhn.redhat.com/errata/RHSA-2010-0095.html
Tags : vendor-advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691

http://marc.info/?l=bugtraq&m=136482797910018&w=2
Tags : vendor-advisory

https://lists.ntp.org/pipermail/announce/2009-December/000086.html
Tags : mailing-list

http://www.vupen.com/english/advisories/2010/0510
Tags : vdb-entry

https://rhn.redhat.com/errata/RHSA-2009-1648.html
Tags : vendor-advisory

http://www.kb.cert.org/vuls/id/MAPG-7X7VD7

http://www.vupen.com/english/advisories/2010/0528
Tags : vdb-entry

https://www.kb.cert.org/vuls/id/417980
Tags : third-party-advisory

날짜	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	55.63%	–	–
2022-03-13	–	–	55.63%	–	–
2023-03-12	–	–	–	96.78%	–
2023-07-16	–	–	–	96.78%	–
2023-08-06	–	–	–	96.69%	–
2023-09-10	–	–	–	96.69%	–
2023-09-17	–	–	–	96.57%	–
2023-11-19	–	–	–	96.57%	–
2024-03-17	–	–	–	96.32%	–
2024-06-02	–	–	–	96.32%	–
2024-06-02	–	–	–	96.32%	–
2024-06-08	–	–	–	96.49%	–
2024-09-01	–	–	–	96.57%	–
2024-10-13	–	–	–	96.52%	–
2024-12-22	–	–	–	96.4%	–
2025-01-19	–	–	–	96.4%	–
2025-03-18	–	–	–	–	64.95%
2025-04-27	–	–	–	–	79.62%
2025-04-28	–	–	–	–	86.34%
2025-04-30	–	–	–	–	86.98%
2025-05-03	–	–	–	–	87.7%
2025-05-05	–	–	–	–	83.12%
2025-06-06	–	–	–	–	85.12%
2025-08-10	–	–	–	–	86.93%
2025-10-08	–	–	–	–	87.07%
2025-10-21	–	–	–	–	86.93%
2025-11-18	–	–	–	–	86.93%
2025-11-21	–	–	–	–	86.93%
2025-11-24	–	–	–	–	87.7%
2025-12-13	–	–	–	–	87.28%
2025-12-21	–	–	–	–	82.43%
2025-12-27	–	–	–	–	83.12%
2025-12-28	–	–	–	–	82.43%
2026-02-22	–	–	–	–	81.69%
2026-03-01	–	–	–	–	81.09%
2026-03-22	–	–	–	–	79.91%
2026-03-29	–	–	–	–	79.63%
2026-05-10	–	–	–	–	81.11%

날짜	백분위수
2022-02-06	98%
2022-03-13	99%
2023-03-12	99%
2023-07-16	1%
2023-08-06	99%
2023-09-10	1%
2023-09-17	99%
2023-11-19	1%
2024-03-17	1%
2024-06-02	1%
2024-06-02	1%
2024-06-08	1%
2024-09-01	1%
2024-10-13	1%
2024-12-22	1%
2025-01-19	1%
2025-03-18	98%
2025-04-27	99%
2025-04-28	99%
2025-04-30	99%
2025-05-03	99%
2025-05-05	99%
2025-06-06	99%
2025-08-10	99%
2025-10-08	99%
2025-10-21	99%
2025-11-18	1%
2025-11-21	99%
2025-11-24	99%
2025-12-13	99%
2025-12-21	99%
2025-12-27	99%
2025-12-28	99%
2026-02-22	99%
2026-03-01	99%
2026-03-22	99%
2026-03-29	99%
2026-05-10	99%

CVE-2009-3563 : 상세 정보

CVE-2009-3563