CVE-2004-0657

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-08-06 · updated 2026-06-16
Weakness: CWE-190

Description

Integer overflow in the NTP daemon (NTPd) before 4.0 causes the NTP server to return the wrong date/time offset when a client requests a date/time that is more than 34 years away from the server's time.

Affected products

HP Tru64 Unix: 4.0f-patch_kit8, 4.0g-patch_kit4, 5.1b-patch_kit2, 5.1b-patch_kit3, 5.1b-patch_kit4, 51.1a-patch_kit6
NTP: before 4.0 — fixed in 4.0

How to fix

Upgrade to a fixed version: NTP 4.0. Check the vendor advisory for mitigations.

References

http://marc.info/?l=bugtraq&m=108922292425219&w=2
http://www.kb.cert.org/vuls/id/584606
https://exchange.xforce.ibmcloud.com/vulnerabilities/15406
http://marc.info/?l=bugtraq&m=108922292425219&w=2
http://www.kb.cert.org/vuls/id/584606
https://exchange.xforce.ibmcloud.com/vulnerabilities/15406

Get alerted when CVE-2004-0657 or the next vulnerability affects your stack