PT-2014-1839 · Ntp+9 · Ntp+10
Publicado
2014-12-19
·
Atualizado
2024-06-15
·
CVE-2014-9294
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
NTP versions prior to 4.2.7p230
NTP versions 4.2.6p5 and earlier
Description
The issue is related to a weak RNG seed used in the ntp-keygen utility, making it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. This can lead to a violation of confidentiality, integrity, and availability of protected information. The vulnerability can be exploited remotely.
Recommendations
For NTP versions prior to 4.2.7p230, update to version 4.2.7p230 or later to resolve the issue.
For NTP versions 4.2.6p5 and earlier, update to a version later than 4.2.6p5 to mitigate the risk.
As a temporary workaround, consider restricting access to the ntp-keygen utility until a patch is available.
Exploit
Correção
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Check Point Gaia
Cisco Ios Xr
Cisco Nexus
Hp-Ux
Ibm Aix
Ntp
Red Hat
Suse
Ubuntu