CVE catalog
CVE-2005-2496
ntp - programming error
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.45% · Oct 25, 2026
The xntpd ntp (ntpd) daemon before 4.2.0b, when run with the -u option and using a string to specify the group, uses the group ID of the user instead of the group, which causes xntpd to run with different privileges than intended.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ntp | 11 | 1:4.2.0a+stable-2sarge1 | fixed |
| Debian | ntp | 3.1 | 1:4.2.0a+stable-2 | vulnerable |
| Debian | ntp | 3.1 | 1:4.2.0a+stable-2sarge1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ntp | deb | 11 | 1:4.2.0a+stable-2sarge1 | Not reported | DEBIAN-CVE-2005-2496 | Not reported |
| Debian | ntp | deb | 3.1 | 1:4.2.0a+stable-2sarge1 | Not reported | DSA-801-1 | Not reported |
OpenFactory catalog packages
No matching packages in this catalog.
Observed: