CVE-2001-0414: ntpd readvar buffer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication, and full confidentiality, integrity and availability impact.

What it is

ntpd (xntpd/xntp3) 4.0.99k and earlier contains a buffer overflow reachable through a long readvar argument. A remote attacker can crash the daemon and potentially execute arbitrary commands, making this a serious flaw for any exposed NTP service.

Impact

An attacker gains the ability to cause a denial of service and, per the description, possibly execute arbitrary commands on the affected host.

Attack surface

Reachable over the network via the NTP service with no authentication required, as reflected by the AV:N/AC:L/Au:N vector. No user interaction is indicated.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.91679, 99.8th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade ntpd to a version later than 4.0.99k or apply the vendor patch for your distribution.
• Restrict NTP access to trusted networks with firewall rules and ntpd restrict directives.
• Disable or block the readvar/mode 6 query interface where not required.
• Monitor vendor advisories (FreeBSD, NetBSD, Red Hat, Debian, Mandrake, Caldera, SCO) for the fixed build.
• Run ntpd with least privilege and isolate it from sensitive hosts.

Detection

• Alert on ntpd crashes or restarts and core dumps on NTP servers.
• Inspect NTP mode 6 (readvar) traffic for unusually long or malformed payloads.
• Log and review remote NTP queries from unexpected or external sources.
• Correlate IDS/IPS signatures for ntpd readvar overflow attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.